commit a07afc58f2d765dd02a571354855facdaa6921b8
author Tom Sepez <tsepez@chromium.org> Wed Mar 06 19:53:39 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Mar 06 19:53:39 2019 +0000
tree ec2a6b66b75ee5bce23acc8159c4179dcd472f15
parent 3df5c7cf7b585025bee1f5e30918dd475e5f4363

Fix lookahead check in CFGAS_FormatString::GetNumericFormat().

Bug: 938626
Change-Id: I7dca429a6ccd5cca3dcca2a935159592b457e512
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/51591
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

xfa/fgas/crt/cfgas_formatstring.cpp

diff --git a/xfa/fgas/crt/cfgas_formatstring.cpp b/xfa/fgas/crt/cfgas_formatstring.cpp
index b96203d..3a46756 100644
--- a/xfa/fgas/crt/cfgas_formatstring.cpp
+++ b/xfa/fgas/crt/cfgas_formatstring.cpp
@@ -1056,12 +1056,11 @@
     } else if (pStr[ccf] != '}') {
       *wsPurgePattern += pStr[ccf];
     }
-    if (!bFindDot) {
-      if (pStr[ccf] == '.' || pStr[ccf] == 'V' || pStr[ccf] == 'v') {
-        bFindDot = true;
-        *iDotIndex = wsPurgePattern->GetLength() - 1;
-        *dwStyle |= FX_NUMSTYLE_DotVorv;
-      }
+    if (!bFindDot && ccf < iLenf &&
+        (pStr[ccf] == '.' || pStr[ccf] == 'V' || pStr[ccf] == 'v')) {
+      bFindDot = true;
+      *iDotIndex = wsPurgePattern->GetLength() - 1;
+      *dwStyle |= FX_NUMSTYLE_DotVorv;
     }
     ccf++;
   }

xfa/fgas/crt/cfgas_formatstring_unittest.cpp

diff --git a/xfa/fgas/crt/cfgas_formatstring_unittest.cpp b/xfa/fgas/crt/cfgas_formatstring_unittest.cpp
index 4cd24a2..2037af2 100644
--- a/xfa/fgas/crt/cfgas_formatstring_unittest.cpp
+++ b/xfa/fgas/crt/cfgas_formatstring_unittest.cpp
@@ -420,6 +420,9 @@
   static const TestCase failures[] = {
       // https://crbug.com/pdfium/1260
       {L"en", L"..", L"VC", L"."},
+
+      // https://crbug.com/938626
+      {L"en", L"PDF", L"num( ", L"."},
   };
 
   for (const auto& test : tests) {