commit c3ddec37aab70e1b59d5ff35b1f0d1964efe288f
author Tom Sepez <tsepez@chromium.org> Mon Apr 03 09:42:56 2017 -0700
committer Chromium commit bot <commit-bot@chromium.org> Mon Apr 03 18:20:55 2017 +0000
tree 749aba77f5eae6b5d8621824d3e97deced3cd913
parent 0c972ebccb8c5f250122955780bd632ff5c8630f

Do not shrink buffer before examining last byte in TryVSWPrintF

Bug: 707479
Change-Id: I6deea8ca2408df8715e639c8ff161cbb3d5f8296
Reviewed-on: https://pdfium-review.googlesource.com/3595
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fxcrt/cfx_widestring.cpp

diff --git a/core/fxcrt/cfx_widestring.cpp b/core/fxcrt/cfx_widestring.cpp
index 49a62da..c3be23a 100644
--- a/core/fxcrt/cfx_widestring.cpp
+++ b/core/fxcrt/cfx_widestring.cpp
@@ -611,8 +611,9 @@
   // See https://crbug.com/705912.
   memset(m_pData->m_String, 0, (size + 1) * sizeof(wchar_t));
   int ret = vswprintf(m_pData->m_String, size + 1, pFormat, argList);
+  bool bSufficientBuffer = ret >= 0 || m_pData->m_String[size - 1] == 0;
   ReleaseBuffer();
-  return ret >= 0 || m_pData->m_String[size - 1] == 0;
+  return bSufficientBuffer;
 }
 
 void CFX_WideString::FormatV(const wchar_t* pFormat, va_list argList) {
@@ -627,9 +628,9 @@
   }
   while (nMaxLen < 32 * 1024) {
     FX_VA_COPY(argListCopy, argList);
-    bool bRetryPointless = TryVSWPrintf(nMaxLen, pFormat, argListCopy);
+    bool bSufficientBuffer = TryVSWPrintf(nMaxLen, pFormat, argListCopy);
     va_end(argListCopy);
-    if (bRetryPointless)
+    if (bSufficientBuffer)
       break;
     nMaxLen *= 2;
   }