third_party/agg23/0014-ubsan-render-line.patch

diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp
index d2b6a46e4..2f19a1816 100644
--- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp
+++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp
@@ -227,10 +227,27 @@ AGG_INLINE void outline_aa::render_hline(int ey, int x1, int y1, int x2, int y2)
 void outline_aa::render_line(int x1, int y1, int x2, int y2)
 {
     enum dx_limit_e { dx_limit = 16384 << poly_base_shift };
-    int dx = x2 - x1;
+    pdfium::base::CheckedNumeric<int> safe_dx = x2;
+    safe_dx -= x1;
+    if (!safe_dx.IsValid())
+        return;
+
+    int dx = safe_dx.ValueOrDie();
     if(dx >= dx_limit || dx <= -dx_limit) {
-        int cx = (x1 + x2) >> 1;
-        int cy = (y1 + y2) >> 1;
+        pdfium::base::CheckedNumeric<int> safe_cx = x1;
+        safe_cx += x2;
+        safe_cx /= 2;
+        if (!safe_cx.IsValid())
+            return;
+
+        pdfium::base::CheckedNumeric<int> safe_cy = y1;
+        safe_cy += y2;
+        safe_cy /= 2;
+        if (!safe_cy.IsValid())
+            return;
+
+        int cx = safe_cx.ValueOrDie();
+        int cy = safe_cy.ValueOrDie();
         render_line(x1, y1, cx, cy);
         render_line(cx, cy, x2, y2);
     }