| Index: core/src/fxcodec/codec/fx_codec_fax.cpp
|
| diff --git a/core/src/fxcodec/codec/fx_codec_fax.cpp b/core/src/fxcodec/codec/fx_codec_fax.cpp
|
| index 5af1d9e7ceab99459678d6314b84426fc9518a98..daa8a0713cc9cf0481a88e64f744bacde1650da1 100644
|
| --- a/core/src/fxcodec/codec/fx_codec_fax.cpp
|
| +++ b/core/src/fxcodec/codec/fx_codec_fax.cpp
|
| @@ -656,7 +656,8 @@ FX_BOOL CCodec_FaxDecoder::Create(const uint8_t* src_buf,
|
| if (m_OrigHeight == 0) {
|
| m_OrigHeight = height;
|
| }
|
| - m_Pitch = (m_OrigWidth + 31) / 32 * 4;
|
| + // Should not overflow. Checked by FPDFAPI_CreateFaxDecoder.
|
| + m_Pitch = (static_cast<FX_DWORD>(m_OrigWidth) + 31) / 32 * 4;
|
| m_OutputWidth = m_OrigWidth;
|
| m_OutputHeight = m_OrigHeight;
|
| m_pScanlineBuf = FX_Alloc(uint8_t, m_Pitch);
|
| @@ -716,7 +717,7 @@ uint8_t* CCodec_FaxDecoder::v_GetNextLine() {
|
| }
|
| }
|
| if (m_bBlack) {
|
| - for (int i = 0; i < m_Pitch; i++) {
|
| + for (FX_DWORD i = 0; i < m_Pitch; i++) {
|
| m_pScanlineBuf[i] = ~m_pScanlineBuf[i];
|
| }
|
| }
|
|
|