| dsinclair | 4935e60 | 2016-09-15 12:21:39 -0700 | [diff] [blame] | 1 | diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp |
| 2 | index 46379f6..c6b3f01 100644 |
| 3 | --- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp |
| 4 | +++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp |
| 5 | @@ -48,6 +48,7 @@ |
| 6 | //---------------------------------------------------------------------------- |
| 7 | #include <limits.h> |
| 8 | #include "agg_rasterizer_scanline_aa.h" |
| 9 | +#include "third_party/base/numerics/safe_math.h" |
| 10 | namespace agg |
| 11 | { |
| 12 | AGG_INLINE void cell_aa::set_cover(int c, int a) |
| 13 | @@ -237,7 +238,7 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) |
| 14 | int fy1 = y1 & poly_base_mask; |
| 15 | int fy2 = y2 & poly_base_mask; |
| 16 | int x_from, x_to; |
| 17 | - int p, rem, mod, lift, delta, first, incr; |
| 18 | + int rem, mod, lift, delta, first, incr; |
| 19 | if(ey1 == ey2) { |
| 20 | render_hline(ey1, x1, fy1, x2, fy2); |
| 21 | return; |
| 22 | @@ -268,16 +269,22 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) |
| 23 | m_cur_cell.add_cover(delta, two_fx * delta); |
| 24 | return; |
| 25 | } |
| 26 | - p = (poly_base_size - fy1) * dx; |
| 27 | + pdfium::base::CheckedNumeric<int> safeP = poly_base_size - fy1; |
| 28 | + safeP *= dx; |
| 29 | + if (!safeP.IsValid()) |
| 30 | + return; |
| 31 | first = poly_base_size; |
| 32 | if(dy < 0) { |
| 33 | - p = fy1 * dx; |
| 34 | - first = 0; |
| 35 | - incr = -1; |
| 36 | - dy = -dy; |
| 37 | + safeP = fy1; |
| 38 | + safeP *= dx; |
| 39 | + if (!safeP.IsValid()) |
| 40 | + return; |
| 41 | + first = 0; |
| 42 | + incr = -1; |
| 43 | + dy = -dy; |
| 44 | } |
| 45 | - delta = p / dy; |
| 46 | - mod = p % dy; |
| 47 | + delta = safeP.ValueOrDie() / dy; |
| 48 | + mod = safeP.ValueOrDie() % dy; |
| 49 | if(mod < 0) { |
| 50 | delta--; |
| 51 | mod += dy; |
| 52 | @@ -287,12 +294,15 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) |
| 53 | ey1 += incr; |
| 54 | set_cur_cell(x_from >> poly_base_shift, ey1); |
| 55 | if(ey1 != ey2) { |
| 56 | - p = poly_base_size * dx; |
| 57 | - lift = p / dy; |
| 58 | - rem = p % dy; |
| 59 | - if(rem < 0) { |
| 60 | - lift--; |
| 61 | - rem += dy; |
| 62 | + safeP = static_cast<int>(poly_base_size); |
| 63 | + safeP *= dx; |
| 64 | + if (!safeP.IsValid()) |
| 65 | + return; |
| 66 | + lift = safeP.ValueOrDie() / dy; |
| 67 | + rem = safeP.ValueOrDie() % dy; |
| 68 | + if (rem < 0) { |
| 69 | + lift--; |
| 70 | + rem += dy; |
| 71 | } |
| 72 | mod -= dy; |
| 73 | while(ey1 != ey2) { |
