commit e420d9c1d2ef35c862bf149ae37e6e59287c30b5
author Ryan Harrison <rharrison@chromium.org> Mon Sep 11 15:59:02 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Mon Sep 11 20:13:56 2017 +0000
tree 82e49c8f39ce4be95cfd276c529cb9ead9386bf4
parent 56ec0818c3ed195c8de2daba951ddbcb4dc7d7bc

Add guard against reading more then expected from the page

This really shouldn't ever happen, but there used to be this guard in
this code and I am getting reports of crashes after it was removed. I
have added an assert, so hopefully if it is actually occuring, then we
might get a reproduction case based on a debug build crash.

BUG=chromium:763369

Change-Id: Ifaebfbcb0413a1d7777222ba838aaee234f94ae3
Reviewed-on: https://pdfium-review.googlesource.com/13691
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

fpdfsdk/fpdftext.cpp

diff --git a/fpdfsdk/fpdftext.cpp b/fpdfsdk/fpdftext.cpp
index 6a030b8..ee43547 100644
--- a/fpdfsdk/fpdftext.cpp
+++ b/fpdfsdk/fpdftext.cpp
@@ -175,6 +175,10 @@
   if (str.GetLength() <= 0)
     return 0;
 
+  ASSERT(str.GetLength() <= static_cast<FX_STRSIZE>(count));
+  if (str.GetLength() > static_cast<FX_STRSIZE>(count))
+    str = str.Left(static_cast<FX_STRSIZE>(count));
+
   // UFT16LE_Encode doesn't handle surrogate pairs properly, so it is expected
   // the number of items to stay the same.
   CFX_ByteString cbUTF16str = str.UTF16LE_Encode();