commit 5a7eb44f1bcfe843f7810acf60fa6c59bd13ded2
author Chris Palmer <palmer@google.com> Thu Jul 31 12:08:56 2014 -0700
committer Bo Xu <bo_xu@foxitsoftware.com> Mon Aug 11 14:51:52 2014 -0700
tree 721a42ef7f98c92672fbedf9b82a590e3e9a2c88
parent b1a807fddac0047740e3ebefd24de22d3a390266

Correct the names of the FX_SAFE_* typedefs.

R=jun_fang@foxitsoftware.com

Review URL: https://codereview.chromium.org/417263008

core/include/fxcrt/fx_system.h

diff --git a/core/include/fxcrt/fx_system.h b/core/include/fxcrt/fx_system.h
index 3913803..6d659e2 100644
--- a/core/include/fxcrt/fx_system.h
+++ b/core/include/fxcrt/fx_system.h
@@ -277,9 +277,9 @@
 };
 
 #include "../../../third_party/numerics/safe_math.h"
-typedef base::CheckedNumeric<FX_DWORD> 		FX_SAFE_DWORD;
-typedef base::CheckedNumeric<FX_INT32> 		FX_SAFE_INT;
-typedef base::CheckedNumeric<size_t>            FX_SAFE_SIZET;
+typedef base::CheckedNumeric<FX_DWORD> FX_SAFE_DWORD;
+typedef base::CheckedNumeric<FX_INT32> FX_SAFE_INT32;
+typedef base::CheckedNumeric<size_t>   FX_SAFE_SIZE_T;
 #if defined(__clang__) || _MSC_VER >= 1700
 #define FX_FINAL final
 #elif defined(__GNUC__) && __cplusplus >= 201103 && \

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
index ae96148..d2172bf 100644
--- a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
+++ b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
@@ -1203,6 +1203,15 @@
         FXSYS_memset32(dest_scan, 0xff, dest_Bpp * clip_width);
         return;
     }
+
+    FX_SAFE_INT32 max_src_x = clip_left;
+    max_src_x += clip_width - 1;
+    max_src_x *= src_width;
+    max_src_x /= dest_width;
+    if (!max_src_x.IsValid()) {
+        return;
+    }
+
     CFX_FixedBufGrow<FX_BYTE, 128> temp(orig_Bpp);
     if (bpc * m_nComponents == 1) {
         FX_DWORD set_argb = (FX_DWORD) - 1, reset_argb = 0;

core/src/fxcrt/extension.h

diff --git a/core/src/fxcrt/extension.h b/core/src/fxcrt/extension.h
index d5659e5..598590e 100644
--- a/core/src/fxcrt/extension.h
+++ b/core/src/fxcrt/extension.h
@@ -238,7 +238,7 @@
 
         offset = safeOffset.ValueOrDie();
 
-        FX_SAFE_SIZET newPos = size;
+        FX_SAFE_SIZE_T newPos = size;
         newPos += offset;
         if (!newPos.IsValid() || newPos.ValueOrDefault(0) == 0 || newPos.ValueOrDie() >= m_nCurSize) {
             return FALSE;
@@ -289,7 +289,7 @@
             offset += (FX_FILESIZE)m_nOffset;
         }
         if (m_dwFlags & FX_MEMSTREAM_Consecutive) {
-            FX_SAFE_SIZET newPos = size; 
+            FX_SAFE_SIZE_T newPos = size; 
             newPos += offset;
             if (!newPos.IsValid())
                 return FALSE;
@@ -316,7 +316,7 @@
             return TRUE;
         }
 
-        FX_SAFE_SIZET newPos = size;
+        FX_SAFE_SIZE_T newPos = size;
         newPos += offset;
         if (!newPos.IsValid()) {
             return FALSE;