commit 8d2f700af52767ea7d0e20d42dad3b68a45c2ecd
author Lei Zhang <thestig@chromium.org> Mon Oct 31 18:10:44 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Oct 31 18:10:44 2022 +0000
tree 43b5c1844fbb3d4e6a28775ef8ee55a5a144514e
parent ab6c904a2d27961b5f4a4bfa634e8bdba11bbd9c

Improve integer overflow checking in CStretchEngine::StartStretchHorz().

Instead of manually trying to avoid overflowing an int32_t, switch to
FX_SAFE_SIZE_T instead.

Bug: pdfium:1646
Change-Id: Iab8243fcad32dca1a5c073b09c88b6dc6f81c66e
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/100310
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fxge/dib/cstretchengine.cpp

diff --git a/core/fxge/dib/cstretchengine.cpp b/core/fxge/dib/cstretchengine.cpp
index 271402c..bebfd08 100644
--- a/core/fxge/dib/cstretchengine.cpp
+++ b/core/fxge/dib/cstretchengine.cpp
@@ -274,11 +274,13 @@
   if (m_DestWidth == 0 || m_InterPitch == 0 || m_DestScanline.empty())
     return false;
 
-  if (m_SrcClip.Height() == 0 ||
-      m_SrcClip.Height() > (1 << 29) / m_InterPitch) {
+  FX_SAFE_SIZE_T safe_size = m_SrcClip.Height();
+  safe_size *= m_InterPitch;
+  const size_t size = safe_size.ValueOrDefault(0);
+  if (size == 0)
     return false;
-  }
-  m_InterBuf.resize(m_SrcClip.Height() * m_InterPitch);
+
+  m_InterBuf.resize(size);
   if (m_pSource && m_bHasAlpha && m_pSource->HasAlphaMask()) {
     m_ExtraAlphaBuf.resize(m_SrcClip.Height(), m_ExtraMaskPitch);
     m_DestMaskScanline.resize(m_ExtraMaskPitch);