Check for integer overflows in CFX_Break::IsGreaterThanLineWidth().
BUG=chromium:881095,chromium:928841
Change-Id: I4dd30ab824f2401db83006d447c7cfc8ffd4cfbd
Reviewed-on: https://pdfium-review.googlesource.com/c/50053
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
diff --git a/xfa/fgas/layout/cfx_break.cpp b/xfa/fgas/layout/cfx_break.cpp
index ca293ec..e8f5faf 100644
--- a/xfa/fgas/layout/cfx_break.cpp
+++ b/xfa/fgas/layout/cfx_break.cpp
@@ -83,7 +83,9 @@
}
bool CFX_Break::IsGreaterThanLineWidth(int32_t width) const {
- return width > m_iLineWidth + m_iTolerance;
+ FX_SAFE_INT32 line_width = m_iLineWidth;
+ line_width += m_iTolerance;
+ return line_width.IsValid() && width > line_width.ValueOrDie();
}
FX_CHARTYPE CFX_Break::GetUnifiedCharType(FX_CHARTYPE chartype) const {
