commit 6eda30ee45b7e993cc7f53e2457e9dcbabb3d99f
author Lei Zhang <thestig@chromium.org> Wed Dec 05 23:05:12 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Dec 05 23:05:12 2018 +0000
tree 600f1d35133a782f34169d4be6bb41634c117bdc
parent 190ae8ea5e55b74f81ba1b82d663358bb03ad233

Fix out of bound error in CBC_ErrorCorrection::EncodeECC200().

BUG=chromium:912125

Change-Id: I2284962d2c56bd0eb3a4450bd0fdca53953f443a
Reviewed-on: https://pdfium-review.googlesource.com/c/46610
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

fxbarcode/datamatrix/BC_ErrorCorrection.cpp

diff --git a/fxbarcode/datamatrix/BC_ErrorCorrection.cpp b/fxbarcode/datamatrix/BC_ErrorCorrection.cpp
index 9f6a67f..9c6ff7d 100644
--- a/fxbarcode/datamatrix/BC_ErrorCorrection.cpp
+++ b/fxbarcode/datamatrix/BC_ErrorCorrection.cpp
@@ -22,6 +22,7 @@
 
 #include "fxbarcode/datamatrix/BC_ErrorCorrection.h"
 
+#include <algorithm>
 #include <vector>
 
 #include "fxbarcode/datamatrix/BC_Encoder.h"
@@ -201,6 +202,13 @@
       errorSizes[i] = symbolInfo->getErrorLengthForInterleavedBlock();
       startPos[i] = i > 0 ? startPos[i - 1] + dataSizes[i] : 0;
     }
+
+    size_t max_error_sizes =
+        *std::max_element(errorSizes.begin(), errorSizes.end()) * blockCount;
+    sb.Reserve(sb.GetLength() + max_error_sizes);
+    for (size_t i = 0; i < max_error_sizes; ++i)
+      sb.InsertAtBack(0);
+
     for (size_t block = 0; block < blockCount; ++block) {
       WideString temp;
       if (symbolInfo->dataCapacity() > block)