| Index: ppapi/proxy/pdf_resource.cc
|
| diff --git a/ppapi/proxy/pdf_resource.cc b/ppapi/proxy/pdf_resource.cc
|
| index 384fdc90a35bd218251ee1356a79d50e081e87b9..a735d4334d92cf5eb85d95556ff87438a29c65bc 100644
|
| --- a/ppapi/proxy/pdf_resource.cc
|
| +++ b/ppapi/proxy/pdf_resource.cc
|
| @@ -98,13 +98,16 @@ void PDFResource::SearchString(const unsigned short* input_string,
|
| DCHECK(status == U_ZERO_ERROR);
|
| }
|
|
|
| - *count = static_cast<uint32_t>(pp_results.size());
|
| - if (*count) {
|
| - *results = reinterpret_cast<PP_PrivateFindResult*>(malloc(
|
| - *count * sizeof(PP_PrivateFindResult)));
|
| - memcpy(*results, &pp_results[0], *count * sizeof(PP_PrivateFindResult));
|
| + if (pp_results.empty() ||
|
| + pp_results.size() > std::numeric_limits<uint32_t>::max() ||
|
| + pp_results.size() > SIZE_MAX / sizeof(PP_PrivateFindResult)) {
|
| + *count = 0;
|
| + *results = nullptr;
|
| } else {
|
| - *results = NULL;
|
| + *count = static_cast<uint32_t>(pp_results.size());
|
| + const size_t result_size = pp_results.size() * sizeof(PP_PrivateFindResult);
|
| + *results = reinterpret_cast<PP_PrivateFindResult*>(malloc(result_size));
|
| + memcpy(*results, &pp_results[0], result_size);
|
| }
|
|
|
| usearch_close(searcher);
|
|
|