Use CompositeMask instead of TransferBitmap when drawing type 3 text

TransferBitmap seems to work improperly when the glyph boxes overlap.
In particular, after drawing a glyph, the next glyph's blanks will
override what the previous glyph drew, and this is not the correct
behavior. While on it, use CheckedNumeric to do operations safely.
For reference of somewhere where something similar is done, see:
https://cs.chromium.org/chromium/src/third_party/pdfium/core/fxge/ge/cfx_renderdevice.cpp?sq=package:chromium&rcl=1477581616&l=988

BUG=513954

Review-Url: https://codereview.chromium.org/2461743002

core/fpdfapi/render/fpdf_render_text.cpp

diff --git a/core/fpdfapi/render/fpdf_render_text.cpp b/core/fpdfapi/render/fpdf_render_text.cpp
index b8f44f8..7d29f5c 100644
--- a/core/fpdfapi/render/fpdf_render_text.cpp
+++ b/core/fpdfapi/render/fpdf_render_text.cpp
@@ -29,6 +29,7 @@
 #include "core/fxge/cfx_graphstatedata.h"
 #include "core/fxge/cfx_pathdata.h"
 #include "core/fxge/cfx_renderdevice.h"
+#include "third_party/base/numerics/safe_math.h"
 
 FX_BOOL CPDF_RenderStatus::ProcessText(CPDF_TextObject* textobj,
                                        const CFX_Matrix* pObj2Device,
@@ -314,13 +315,25 @@
     if (!glyph.m_pGlyph)
       continue;
 
-    bitmap.TransferBitmap(
-        static_cast<int>(
-            (glyph.m_OriginX + glyph.m_pGlyph->m_Left - rect.left) * sa),
-        static_cast<int>((glyph.m_OriginY - glyph.m_pGlyph->m_Top - rect.top) *
-                         sd),
-        glyph.m_pGlyph->m_Bitmap.GetWidth(),
-        glyph.m_pGlyph->m_Bitmap.GetHeight(), &glyph.m_pGlyph->m_Bitmap, 0, 0);
+    pdfium::base::CheckedNumeric<int> left = glyph.m_OriginX;
+    left += glyph.m_pGlyph->m_Left;
+    left -= rect.left;
+    left *= sa;
+    if (!left.IsValid())
+      continue;
+
+    pdfium::base::CheckedNumeric<int> top = glyph.m_OriginY;
+    top -= glyph.m_pGlyph->m_Top;
+    top -= rect.top;
+    top *= sd;
+    if (!top.IsValid())
+      continue;
+
+    bitmap.CompositeMask(left.ValueOrDie(), top.ValueOrDie(),
+                         glyph.m_pGlyph->m_Bitmap.GetWidth(),
+                         glyph.m_pGlyph->m_Bitmap.GetHeight(),
+                         &glyph.m_pGlyph->m_Bitmap, fill_argb, 0, 0,
+                         FXDIB_BLEND_NORMAL, nullptr, FALSE, 0, nullptr);
   }
   m_pDevice->SetBitMask(&bitmap, rect.left, rect.top, fill_argb);
   return TRUE;