commit 2fd400c319c68b4b8bd741c0df51c8846c40a276
author Bo Xu <bo_xu@foxitsoftware.com> Thu Jul 31 09:55:36 2014 -0700
committer Bo Xu <bo_xu@foxitsoftware.com> Thu Jul 31 09:55:36 2014 -0700
tree 4ad54aae90cccff87be7107afa06f3ce28d1e481
parent 10ec7ca17e7ec9aa68fd051c5fe5a6c75092dd79

Fix integer overflow when stretch bitmap

When an image object is zoomed in by a big factor, the scaling factor in the transformation matrix is big as well, resulting in a large |dest_width| and |dest_height| value(they can be think of as the equivalent pixel size of the entire image, although most of it is outside the device).

BUG=395636
R=vitalybuka@chromium.org

Review URL: https://codereview.chromium.org/432543002

core/src/fxge/win32/fx_win32_device.cpp

diff --git a/core/src/fxge/win32/fx_win32_device.cpp b/core/src/fxge/win32/fx_win32_device.cpp
index 154bbc4..5e76898 100644
--- a/core/src/fxge/win32/fx_win32_device.cpp
+++ b/core/src/fxge/win32/fx_win32_device.cpp
@@ -523,7 +523,7 @@
         return FALSE;
     }
     CFX_ByteString info = CFX_WindowsDIB::GetBitmapInfo(pBitmap);
-    if (abs(dest_width) * abs(dest_height) < pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 ||
+    if ((FX_INT64)abs(dest_width) * abs(dest_height) < (FX_INT64)pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 ||
             (flags & FXDIB_INTERPOL) || (flags & FXDIB_BICUBIC_INTERPOL)) {
         SetStretchBltMode(m_hDC, HALFTONE);
     } else {
@@ -531,7 +531,7 @@
     }
     CFX_DIBitmap* pToStrechBitmap = pBitmap;
     bool del = false;
-    if (m_DeviceClass == FXDC_PRINTER && (pBitmap->GetWidth() * pBitmap->GetHeight() > abs(dest_width) * abs(dest_height))) {
+    if (m_DeviceClass == FXDC_PRINTER && ((FX_INT64)pBitmap->GetWidth() * pBitmap->GetHeight() > (FX_INT64)abs(dest_width) * abs(dest_height))) {
         pToStrechBitmap = pBitmap->StretchTo(dest_width, dest_height);
         del = true;
     }