commit b848dc9515743b0332d24834e475ce022c5b3353
author Lei Zhang <thestig@chromium.org> Fri Feb 15 19:38:38 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Fri Feb 15 19:38:38 2019 +0000
tree 9e4ff2248656246ab181da9ec1a444c79c608983
parent e6662ef48d8d2d658faa684c6f5b4aa0323d552d

M73: Check for integer overflows in AdjustGlyphSpace().

BUG=chromium:914983
TBR=tsepez@chromium.org

Change-Id: I90f0ae85e547efbe52a27d32a06af10ed65d6722
Reviewed-on: https://pdfium-review.googlesource.com/c/50112
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
(cherry picked from commit 3548a6b6fbd37b727a2c0a5fac2a6b22ddef92d5)
Reviewed-on: https://pdfium-review.googlesource.com/c/50892
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fxge/cfx_renderdevice.cpp

diff --git a/core/fxge/cfx_renderdevice.cpp b/core/fxge/cfx_renderdevice.cpp
index f55ad46..f18966c 100644
--- a/core/fxge/cfx_renderdevice.cpp
+++ b/core/fxge/cfx_renderdevice.cpp
@@ -45,11 +45,23 @@
     float current_origin_f =
         bVertical ? current.m_fOrigin.y : current.m_fOrigin.x;
 
-    int space = next_origin - current_origin;
+    FX_SAFE_INT32 safe_space = next_origin;
+    safe_space -= current_origin;
+    if (!safe_space.IsValid())
+      continue;
+
+    int space = safe_space.ValueOrDie();
     float space_f = next_origin_f - current_origin_f;
     float error = fabs(space_f) - fabs(static_cast<float>(space));
-    if (error > 0.5f)
-      current_origin += space > 0 ? -1 : 1;
+    if (error <= 0.5f)
+      continue;
+
+    FX_SAFE_INT32 safe_origin = current_origin;
+    safe_origin += space > 0 ? -1 : 1;
+    if (!safe_origin.IsValid())
+      continue;
+
+    current_origin = safe_origin.ValueOrDie();
   }
 }