Fix a potential OOB read in CFX_SkiaDeviceDriver::DrawShading(). Consistently use modulo to keep the index into `colors` in bound. Change-Id: I7b048e145c0824214aeb181df789cb61c99af42f Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/103852 Reviewed-by: K. Moon <kmoon@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp index 88a13e5..2e048c5 100644 --- a/core/fxge/skia/fx_skia_device.cpp +++ b/core/fxge/skia/fx_skia_device.cpp
@@ -1877,7 +1877,7 @@ } std::copy(std::begin(temp_cubics), std::end(temp_cubics), std::begin(cubics)); - SkColor temp_colors[2] = {colors[flag], colors[(flag + 1) % 4]}; + SkColor temp_colors[2] = {colors[flag % 4], colors[(flag + 1) % 4]}; std::copy(std::begin(temp_colors), std::end(temp_colors), std::begin(colors)); }