Fixing order of guards to avoid potential segvs
Per tspepez's drive by:
str, in theory, might not be terminated, and might have been allocated
right up to a guard page at the end of the heap, say, so that str[len]
could segv.
Change-Id: I6cba7b6d12b23f69e6f150c1b5296df65c2e0086
Reviewed-on: https://pdfium-review.googlesource.com/28610
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
diff --git a/core/fxge/dib/fx_dib_main.cpp b/core/fxge/dib/fx_dib_main.cpp
index 1349e3e..161d2bd 100644
--- a/core/fxge/dib/fx_dib_main.cpp
+++ b/core/fxge/dib/fx_dib_main.cpp
@@ -97,7 +97,7 @@
int cc = 0;
const wchar_t* str = wsValue.unterminated_c_str();
int len = wsValue.GetLength();
- while (FXSYS_iswspace(str[cc]) && cc < len)
+ while (cc < len && FXSYS_iswspace(str[cc]))
cc++;
if (cc >= len)
@@ -112,7 +112,7 @@
}
if (cc < len && str[cc] == ',') {
cc++;
- while (FXSYS_iswspace(str[cc]) && cc < len)
+ while (cc < len && FXSYS_iswspace(str[cc]))
cc++;
while (cc < len) {
@@ -124,7 +124,7 @@
}
if (cc < len && str[cc] == ',') {
cc++;
- while (FXSYS_iswspace(str[cc]) && cc < len)
+ while (cc < len && FXSYS_iswspace(str[cc]))
cc++;
while (cc < len) {
