Index: ppapi/proxy/pdf_resource.cc |
diff --git a/ppapi/proxy/pdf_resource.cc b/ppapi/proxy/pdf_resource.cc |
index 384fdc90a35bd218251ee1356a79d50e081e87b9..a735d4334d92cf5eb85d95556ff87438a29c65bc 100644 |
--- a/ppapi/proxy/pdf_resource.cc |
+++ b/ppapi/proxy/pdf_resource.cc |
@@ -98,13 +98,16 @@ void PDFResource::SearchString(const unsigned short* input_string, |
DCHECK(status == U_ZERO_ERROR); |
} |
- *count = static_cast<uint32_t>(pp_results.size()); |
- if (*count) { |
- *results = reinterpret_cast<PP_PrivateFindResult*>(malloc( |
- *count * sizeof(PP_PrivateFindResult))); |
- memcpy(*results, &pp_results[0], *count * sizeof(PP_PrivateFindResult)); |
+ if (pp_results.empty() || |
+ pp_results.size() > std::numeric_limits<uint32_t>::max() || |
+ pp_results.size() > SIZE_MAX / sizeof(PP_PrivateFindResult)) { |
+ *count = 0; |
+ *results = nullptr; |
} else { |
- *results = NULL; |
+ *count = static_cast<uint32_t>(pp_results.size()); |
+ const size_t result_size = pp_results.size() * sizeof(PP_PrivateFindResult); |
+ *results = reinterpret_cast<PP_PrivateFindResult*>(malloc(result_size)); |
+ memcpy(*results, &pp_results[0], result_size); |
} |
usearch_close(searcher); |