commit bc7073ead4af2c5c907d288ca15a596aed16f97f
author Lei Zhang <thestig@chromium.org> Fri Jun 21 18:56:15 2019 +0000
committer Lei Zhang <thestig@chromium.org> Fri Jun 21 18:56:15 2019 +0000
tree 78dee97b420bf1bdaf68d293cc8e0af947024c4a
parent 417faf4c3ba2e525341562a6aa04e28e5de72f7c

M76: Fix an integer overflow in CPDF_RenderStatus::ProcessType3Text().

BUG=chromium:966263
TBR=tsepez@chromium.org

Change-Id: I4a8afc06d12cdc50530d1b3fea9a623af6bca799
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/55351
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
(cherry picked from commit 7e3d240573fa3fb8c73f4ef1c4e258485e7bb054)
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/56713
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fpdfapi/render/cpdf_renderstatus.cpp

diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index 1c28227..63d3165 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -1900,9 +1900,18 @@
 
         CFX_Point origin(FXSYS_round(matrix.e), FXSYS_round(matrix.f));
         if (glyphs.empty()) {
-          m_pDevice->SetBitMask(pBitmap->GetBitmap(),
-                                origin.x + pBitmap->left(),
-                                origin.y - pBitmap->top(), fill_argb);
+          FX_SAFE_INT32 left = origin.x;
+          left += pBitmap->left();
+          if (!left.IsValid())
+            continue;
+
+          FX_SAFE_INT32 top = origin.y;
+          top -= pBitmap->top();
+          if (!top.IsValid())
+            continue;
+
+          m_pDevice->SetBitMask(pBitmap->GetBitmap(), left.ValueOrDie(),
+                                top.ValueOrDie(), fill_argb);
         } else {
           glyphs[iChar].m_pGlyph = pBitmap;
           glyphs[iChar].m_Origin = origin;