From f348235cce75d378a17f3aee81a97f92049fa0a8 Mon Sep 17 00:00:00 2001
From: Oliver Chang <ochang@chromium.org>
Date: Fri, 19 Feb 2016 15:23:30 -0800
Subject: Add a proper bounds check to XFA_FM_KeywordToString

R=tsepez@chromium.org
BUG=588200

Review URL: https://codereview.chromium.org/1718453003 .
---
 xfa/src/fxfa/src/fm2js/xfa_lexer.cpp | 10 ++++++----
 xfa/src/fxfa/src/fm2js/xfa_lexer.h   |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

(limited to 'xfa/src/fxfa')

diff --git a/xfa/src/fxfa/src/fm2js/xfa_lexer.cpp b/xfa/src/fxfa/src/fm2js/xfa_lexer.cpp
index 957c21b874..2902f8c70b 100644
--- a/xfa/src/fxfa/src/fm2js/xfa_lexer.cpp
+++ b/xfa/src/fxfa/src/fm2js/xfa_lexer.cpp
@@ -83,7 +83,7 @@ inline FX_BOOL XFA_FMDChar::isUnicodeAlpha(uint16_t ch) {
   return TRUE;
 }
 
-XFA_FMKeyword keyWords[] = {
+const XFA_FMKeyword keyWords[] = {
     {TOKand, 0x00000026, L"&"},
     {TOKlparen, 0x00000028, L"("},
     {TOKrparen, 0x00000029, L")"},
@@ -145,13 +145,15 @@ XFA_FMKeyword keyWords[] = {
     {TOKendif, 0xe0e8fee6, L"endif"},
 };
 
-const FX_WORD KEYWORD_START = TOKdo;
-const FX_WORD KEYWORD_END = TOKendif;
+const XFA_FM_TOKEN KEYWORD_START = TOKdo;
+const XFA_FM_TOKEN KEYWORD_END = TOKendif;
 
 }  // namespace
 
 const FX_WCHAR* XFA_FM_KeywordToString(XFA_FM_TOKEN op) {
-  return keyWords[op].m_keword;
+  if (op < KEYWORD_START || op > KEYWORD_END)
+    return L"";
+  return keyWords[op].m_keyword;
 }
 
 CXFA_FMToken::CXFA_FMToken() : m_type(TOKreserver), m_uLinenum(1) {}
diff --git a/xfa/src/fxfa/src/fm2js/xfa_lexer.h b/xfa/src/fxfa/src/fm2js/xfa_lexer.h
index 5db3b093cd..ccfa9f546e 100644
--- a/xfa/src/fxfa/src/fm2js/xfa_lexer.h
+++ b/xfa/src/fxfa/src/fm2js/xfa_lexer.h
@@ -83,7 +83,7 @@ enum XFA_FM_TOKEN {
 struct XFA_FMKeyword {
   XFA_FM_TOKEN m_type;
   uint32_t m_uHash;
-  const FX_WCHAR* m_keword;
+  const FX_WCHAR* m_keyword;
 };
 
 const FX_WCHAR* XFA_FM_KeywordToString(XFA_FM_TOKEN op);
-- 
cgit v1.2.3