Prevent buffer underflow in CPDF_TextObject::CalcPositionData

core/src/fpdfapi/fpdf_page/fpdf_page.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "pageint.h"
 
 #include "core/include/fpdfapi/fpdf_module.h"
 #include "core/include/fpdfapi/fpdf_page.h"
@@ skipping 391 matching lines @@
   CPDF_Font* pFont = m_TextState.GetFont();
   FX_BOOL bVertWriting = FALSE;
   CPDF_CIDFont* pCIDFont = pFont->GetCIDFont();
   if (pCIDFont) {
     bVertWriting = pCIDFont->IsVertWriting();
   }
   FX_FLOAT fontsize = m_TextState.GetFontSize();
   for (int i = 0; i < m_nChars; ++i) {
     FX_DWORD charcode =
         m_nChars == 1 ? (FX_DWORD)(uintptr_t)m_pCharCodes : m_pCharCodes[i];
-    if (charcode == (FX_DWORD)-1) {
-      curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000;
-      continue;
-    }
-    if (i) {
+    if (i > 0) {
+      if (charcode == (FX_DWORD)-1) {
+        curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000;
+        continue;
+      }
       m_pCharPos[i - 1] = curpos;
     }
     FX_RECT char_rect;
     pFont->GetCharBBox(charcode, char_rect, level);
     FX_FLOAT charwidth;
     if (!bVertWriting) {
       if (min_y > char_rect.top) {
         min_y = (FX_FLOAT)char_rect.top;
       }
       if (max_y < char_rect.top) {
@@ skipping 579 matching lines @@
                      (FX_FLOAT)y0);
   matrix = m_PageMatrix;
   matrix.Concat(display_matrix);
 }
 CPDF_ParseOptions::CPDF_ParseOptions() {
   m_bTextOnly = FALSE;
   m_bMarkedContent = TRUE;
   m_bSeparateForm = TRUE;
   m_bDecodeInlineImage = FALSE;
 }