Merge to XFA: Prevent buffer underflow in CPDF_TextObject::CalcPositionData

core/src/fpdfapi/fpdf_page/fpdf_page.cpp

Index: core/src/fpdfapi/fpdf_page/fpdf_page.cpp
diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page.cpp
index eaa8ef112722c411d2b927ad0a64b667a4821cad..3777cd078cc75d91cf7b928fe30b8653c5a70694 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page.cpp
@@ -409,11 +409,11 @@ void CPDF_TextObject::CalcPositionData(FX_FLOAT* pTextAdvanceX,
   for (int i = 0; i < m_nChars; ++i) {
     FX_DWORD charcode =
         m_nChars == 1 ? (FX_DWORD)(uintptr_t)m_pCharCodes : m_pCharCodes[i];
-    if (charcode == (FX_DWORD)-1) {
-      curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000;
-      continue;
-    }
-    if (i) {
+    if (i > 0) {
+      if (charcode == (FX_DWORD)-1) {
+        curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000;
+        continue;
+      }
       m_pCharPos[i - 1] = curpos;
     }
     FX_RECT char_rect;