| commit | 7abb469ef7ebbce4645165d1d0e1dbb6c8e68461 | [log] [tgz] |
|---|---|---|
| author | Lei Zhang <thestig@chromium.org> | Mon Feb 11 22:05:23 2019 +0000 |
| committer | Chromium commit bot <commit-bot@chromium.org> | Mon Feb 11 22:05:23 2019 +0000 |
| tree | 7e7b6b233be7178305c3c1f050f48c036707c35c | |
| parent | 3f684bd7979990aacd26cc6104ef3bbeffbd19d8 [diff] |
Disallow invalid colspan values in RelocateTableRowCells(). BUG=chromium:913561 Change-Id: I5f184eb1a241c6b860d303c59ade3234b05eb7eb Reviewed-on: https://pdfium-review.googlesource.com/c/50391 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org>
diff --git a/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp b/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp index 7271930..a4e875c 100644 --- a/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp +++ b/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
@@ -217,6 +217,9 @@ int32_t nOriginalColSpan = pLayoutChild->GetFormNode()->JSObject()->GetInteger( XFA_Attribute::ColSpan); + if (nOriginalColSpan <= 0 && nOriginalColSpan != -1) + continue; + int32_t nColSpan = nOriginalColSpan; float fColSpanWidth = 0; if (nColSpan == -1 ||