Fix integer underflow in cfgas_stringformatter.cpp, part 2
A prior CL fixed the possibility of overflow, but there is also a
possibility of underflow if there are several 'E' directives in the
input format string and we have previously negated the exponent.
So discard any accumulated exponent before parsing the exponent again.
Bug: chromium:947188
Change-Id: Ie4236f3b6d955810e0481575a7b73beb458ccd23
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/53350
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/xfa/fgas/crt/cfgas_stringformatter.cpp b/xfa/fgas/crt/cfgas_stringformatter.cpp
index 02ace49..9169820 100644
--- a/xfa/fgas/crt/cfgas_stringformatter.cpp
+++ b/xfa/fgas/crt/cfgas_stringformatter.cpp
@@ -1216,6 +1216,7 @@
ccf--;
break;
case 'E': {
+ iExponent = 0;
bool bExpSign = false;
while (cc < spSrcNum.size()) {
if (spSrcNum[cc] == 'E' || spSrcNum[cc] == 'e')
@@ -1407,6 +1408,7 @@
(spSrcNum[cc] != 'E' && spSrcNum[cc] != 'e')) {
return false;
}
+ iExponent = 0;
bool bExpSign = false;
cc++;
if (cc < spSrcNum.size()) {
diff --git a/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp b/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp
index 1803acf..45a2b60 100644
--- a/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp
+++ b/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp
@@ -465,6 +465,9 @@
// https://crbug.com/945836
{L"en", L"9.E99999999999", L"EdEE.E999", L""},
+
+ // https://crbug.com/947188
+ {L"en", L"-3.E98998998 ", L" 35EEEE.EE98", L""},
};
for (const auto& test : tests) {
