Fix undefined behavior in DrawGouraud()
Use pdfium::ClampSub() to avoid undefined behavior in some DrawGouraud()
calculations. The exact result is not critical, as it only affects pixel
values.
Bug: chromium:40813106
Change-Id: I7eaecb1f64fa1c4f46c051280337f0d414a582f0
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/117730
Reviewed-by: Thomas Sepez <tsepez@google.com>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/render/cpdf_rendershading.cpp b/core/fpdfapi/render/cpdf_rendershading.cpp
index f4aa82d..edd7e60 100644
--- a/core/fpdfapi/render/cpdf_rendershading.cpp
+++ b/core/fpdfapi/render/cpdf_rendershading.cpp
@@ -28,6 +28,7 @@
#include "core/fxcrt/check_op.h"
#include "core/fxcrt/fx_safe_types.h"
#include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/numerics/clamped_math.h"
#include "core/fxcrt/span.h"
#include "core/fxcrt/span_util.h"
#include "core/fxcrt/unowned_ptr.h"
@@ -395,11 +396,11 @@
int start_x = std::clamp(min_x, 0, pBitmap->GetWidth());
int end_x = std::clamp(max_x, 0, pBitmap->GetWidth());
- const int range_x = max_x - min_x;
+ const int range_x = pdfium::ClampSub(max_x, min_x);
float r_unit = (r[end_index] - r[start_index]) / range_x;
float g_unit = (g[end_index] - g[start_index]) / range_x;
float b_unit = (b[end_index] - b[start_index]) / range_x;
- const int diff_x = start_x - min_x;
+ const int diff_x = pdfium::ClampSub(start_x, min_x);
float r_result = r[start_index] + diff_x * r_unit;
float g_result = g[start_index] + diff_x * g_unit;
float b_result = b[start_index] + diff_x * b_unit;
