commit 9d43ad95eb1f169ddce562a30f43a4e08cdf9615
author Lei Zhang <thestig@chromium.org> Mon Mar 10 11:40:09 2025 -0700
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Mar 10 11:40:09 2025 -0700
tree 5673a6cd823601dd42559debe7246c1cdba00184
parent 139b934071d661ba953e8e4edbaf57d3c262fa23

Avoid integer overflow when calculating loose char box

Calling FX_RECT::Height() can potentially cause an integer overflow, so
guard that with FX_RECT::IsValid().

Bug: 399144235
Change-Id: I3ab9810fd7979935e9ed29bba1c1967f78976bfd
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/129351
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Thomas Sepez <tsepez@google.com>

core/fpdftext/cpdf_textpage.cpp

diff --git a/core/fpdftext/cpdf_textpage.cpp b/core/fpdftext/cpdf_textpage.cpp
index 57286a8..0522257 100644
--- a/core/fpdftext/cpdf_textpage.cpp
+++ b/core/fpdftext/cpdf_textpage.cpp
@@ -297,7 +297,7 @@
     }
 
     FX_RECT font_bbox = font->GetFontBBox();
-    if (font_bbox.Height() != 0) {
+    if (font_bbox.Valid() && font_bbox.Height() != 0) {
       // Compute `left` and `right` based on the individual character's `width`.
       float width = text_object->GetCharWidth(charinfo.char_code());
       CFX_Matrix inverse_matrix = charinfo.matrix().GetInverse();