commit 8252bc1e5a42ab406fb5f9f968623ea0c83b8656
author thestig <thestig@chromium.org> Tue Aug 23 18:11:30 2016 -0700
committer Commit bot <commit-bot@chromium.org> Tue Aug 23 18:11:30 2016 -0700
tree f75fa8a136e9bb076f711d1ae280ecfcbcd7d84a
parent 837735660808d52580703183ae24a3c7c7b05c7d

Fix one more integer overflow in ReadPageHintTable().

BUG=637119

Review-Url: https://codereview.chromium.org/2274723002

core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp

diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
index 18a7b8f..4363d39 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
@@ -122,7 +122,7 @@
   // than enough to represent most of the values here.
   constexpr uint32_t kMaxBits = 34;
   if (dwSharedObjBits > kMaxBits || dwDeltaObjectsBits > kMaxBits ||
-      dwSharedIdBits > kMaxBits) {
+      dwDeltaPageLenBits > kMaxBits || dwSharedIdBits > kMaxBits) {
     return false;
   }