commit 46e8ecf84c0227298c5aca8ea587bd6b2bce4c87
author Lei Zhang <thestig@chromium.org> Fri Jun 30 18:06:36 2017 -0700
committer Chromium commit bot <commit-bot@chromium.org> Sat Jul 01 01:19:54 2017 +0000
tree 7d97475c43d850fe81c9e0d88747e3ada503fceb
parent 60d92de2dcab52523829de81c5cd1e50b3f8414f

M60: Fix a buffer overflow in FPDFPage_Flatten().

BUG=chromium:732661
TBR=dsinclair@chromium.org

Change-Id: Ie11a7d97db97ac969fb6230956efbf21c2ed3d87
Reviewed-on: https://pdfium-review.googlesource.com/6555
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
(cherry picked from commit f0f2a2a528e154b8ceeded297abc3a64007850f8)
Reviewed-on: https://pdfium-review.googlesource.com/7231
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

fpdfsdk/fpdf_flatten.cpp

diff --git a/fpdfsdk/fpdf_flatten.cpp b/fpdfsdk/fpdf_flatten.cpp
index 0477d6f..914008c 100644
--- a/fpdfsdk/fpdf_flatten.cpp
+++ b/fpdfsdk/fpdf_flatten.cpp
@@ -305,15 +305,18 @@
   if (!pPageXObject)
     pPageXObject = pRes->SetNewFor<CPDF_Dictionary>("XObject");
 
-  CFX_ByteString key = "";
+  CFX_ByteString key;
   int nStreams = pdfium::CollectionSize<int>(ObjectArray);
   if (nStreams > 0) {
-    for (int iKey = 0; /*iKey < 100*/; iKey++) {
-      char sExtend[5] = {};
-      FXSYS_itoa(iKey, sExtend, 10);
-      key = CFX_ByteString("FFT") + CFX_ByteString(sExtend);
-      if (!pPageXObject->KeyExist(key))
+    CFX_ByteString sKey;
+    int i = 0;
+    while (i < INT_MAX) {
+      sKey.Format("FFT%d", i);
+      if (!pPageXObject->KeyExist(sKey)) {
+        key = sKey;
         break;
+      }
+      ++i;
     }
   }