commit 4d9590003c4af2a6109ca175bf450c38a6d27e3b
author Alan Screen <awscreen@chromium.org> Thu Jan 23 22:42:53 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Thu Jan 23 22:42:53 2020 +0000
tree 832f5e403a136dd0f87ad58538a63da138eafdc6
parent 4ca4628ef26bffbd351cdfb1e8bcdc6fa44abad7

[FXCRT] Fix overflow for CFX_FloatRect::GetInnerRect()

Resolve overflow issue when converting the rectangle from
representation with floats to one with integers.

Similar to the unexpected behavior uncovered during debugging of Windows
print imaging issue in crbug.com/1019026.  This is the GetInnerRect()
equivalent to the change in [1].

[1] https://pdfium-review.googlesource.com/c/pdfium/+/62213

Change-Id: Ifdf8f4fbe9e688d1affeff1aa2b5668192985e38
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/64090
Commit-Queue: Alan Screen <awscreen@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fxcrt/fx_coordinates.cpp

diff --git a/core/fxcrt/fx_coordinates.cpp b/core/fxcrt/fx_coordinates.cpp
index dc48fb9..34a0180 100644
--- a/core/fxcrt/fx_coordinates.cpp
+++ b/core/fxcrt/fx_coordinates.cpp
@@ -138,10 +138,10 @@
 
 FX_RECT CFX_FloatRect::GetInnerRect() const {
   FX_RECT rect;
-  rect.left = static_cast<int>(ceil(left));
-  rect.bottom = static_cast<int>(floor(top));
-  rect.right = static_cast<int>(floor(right));
-  rect.top = static_cast<int>(ceil(bottom));
+  rect.left = pdfium::base::saturated_cast<int>(ceil(left));
+  rect.bottom = pdfium::base::saturated_cast<int>(floor(top));
+  rect.right = pdfium::base::saturated_cast<int>(floor(right));
+  rect.top = pdfium::base::saturated_cast<int>(ceil(bottom));
   rect.Normalize();
   return rect;
 }

core/fxcrt/fx_coordinates_unittest.cpp

diff --git a/core/fxcrt/fx_coordinates_unittest.cpp b/core/fxcrt/fx_coordinates_unittest.cpp
index eaf431b..7539ab7 100644
--- a/core/fxcrt/fx_coordinates_unittest.cpp
+++ b/core/fxcrt/fx_coordinates_unittest.cpp
@@ -125,16 +125,16 @@
                        kMaxIntAsFloat);
   inner_rect = rect.GetInnerRect();
   EXPECT_EQ(kMinInt, inner_rect.left);
-  EXPECT_EQ(kMinInt, inner_rect.bottom);  // should be |kMaxInt|
-  EXPECT_EQ(kMinInt, inner_rect.right);   // should be |kMaxInt|
+  EXPECT_EQ(kMaxInt, inner_rect.bottom);
+  EXPECT_EQ(kMaxInt, inner_rect.right);
   EXPECT_EQ(kMinInt, inner_rect.top);
 
   rect = CFX_FloatRect(kMinIntAsFloat - 1.0f, kMinIntAsFloat - 1.0f,
                        kMaxIntAsFloat + 1.0f, kMaxIntAsFloat + 1.0f);
   inner_rect = rect.GetInnerRect();
   EXPECT_EQ(kMinInt, inner_rect.left);
-  EXPECT_EQ(kMinInt, inner_rect.bottom);  // should be |kMaxInt|
-  EXPECT_EQ(kMinInt, inner_rect.right);   // should be |kMaxInt|
+  EXPECT_EQ(kMaxInt, inner_rect.bottom);
+  EXPECT_EQ(kMaxInt, inner_rect.right);
   EXPECT_EQ(kMinInt, inner_rect.top);
 }