Fix a potential OOB read in CFX_SkiaDeviceDriver::DrawShading().
Consistently use modulo to keep the index into `colors` in bound.
Change-Id: I7b048e145c0824214aeb181df789cb61c99af42f
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/103852
Reviewed-by: K. Moon <kmoon@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp
index 88a13e5..2e048c5 100644
--- a/core/fxge/skia/fx_skia_device.cpp
+++ b/core/fxge/skia/fx_skia_device.cpp
@@ -1877,7 +1877,7 @@
}
std::copy(std::begin(temp_cubics), std::end(temp_cubics),
std::begin(cubics));
- SkColor temp_colors[2] = {colors[flag], colors[(flag + 1) % 4]};
+ SkColor temp_colors[2] = {colors[flag % 4], colors[(flag + 1) % 4]};
std::copy(std::begin(temp_colors), std::end(temp_colors),
std::begin(colors));
}
