Use bounds-checked spancpy() in cpdf_rendershading.cpp Change-Id: Ib7228dd01ad278265b8fcd10fd4381002a6e3c0c Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/100891 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fpdfapi/render/cpdf_rendershading.cpp b/core/fpdfapi/render/cpdf_rendershading.cpp index a2fc4bc..e2fe6fc 100644 --- a/core/fpdfapi/render/cpdf_rendershading.cpp +++ b/core/fpdfapi/render/cpdf_rendershading.cpp
@@ -26,6 +26,7 @@ #include "core/fpdfapi/render/cpdf_renderoptions.h" #include "core/fxcrt/fx_safe_types.h" #include "core/fxcrt/fx_system.h" +#include "core/fxcrt/span_util.h" #include "core/fxge/cfx_defaultrenderdevice.h" #include "core/fxge/cfx_fillrenderoptions.h" #include "core/fxge/cfx_path.h" @@ -820,11 +821,12 @@ for (i = 0; i < 4; i++) { tempCoords[i] = coords[(flag * 3 + i) % 12]; } - memcpy(coords, tempCoords, sizeof(tempCoords)); - CoonColor tempColors[2]; - tempColors[0] = patch.patch_colors[flag]; - tempColors[1] = patch.patch_colors[(flag + 1) % 4]; - memcpy(patch.patch_colors, tempColors, sizeof(CoonColor) * 2); + fxcrt::spancpy(pdfium::make_span(coords), pdfium::make_span(tempCoords)); + CoonColor tempColors[2] = { + tempColors[0] = patch.patch_colors[flag], + tempColors[1] = patch.patch_colors[(flag + 1) % 4]}; + fxcrt::spancpy(pdfium::make_span(patch.patch_colors), + pdfium::make_span(tempColors)); } for (i = iStartPoint; i < point_count; i++) { if (!stream.CanReadCoords())