| Index: fpdfsdk/src/fpdfview.cpp
|
| diff --git a/fpdfsdk/src/fpdfview.cpp b/fpdfsdk/src/fpdfview.cpp
|
| index daf9cfcbcfaa8cf8e0a4122fdc927ffabb53182d..8a7130fcf11107a9afd6f9d7f7a767b743de8098 100644
|
| --- a/fpdfsdk/src/fpdfview.cpp
|
| +++ b/fpdfsdk/src/fpdfview.cpp
|
| @@ -825,11 +825,15 @@ DLLEXPORT FPDF_DWORD STDCALL FPDF_CountNamedDests(FPDF_DOCUMENT document) {
|
| return 0;
|
|
|
| CPDF_NameTree nameTree(pDoc, "Dests");
|
| - int count = nameTree.GetCount();
|
| + pdfium::base::CheckedNumeric<FPDF_DWORD> count = nameTree.GetCount();
|
| CPDF_Dictionary* pDest = pRoot->GetDict("Dests");
|
| if (pDest)
|
| count += pDest->GetCount();
|
| - return count;
|
| +
|
| + if (!count.IsValid())
|
| + return 0;
|
| +
|
| + return count.ValueOrDie();
|
| }
|
|
|
| DLLEXPORT FPDF_DEST STDCALL FPDF_GetNamedDestByName(FPDF_DOCUMENT document,
|
| @@ -863,21 +867,25 @@ DLLEXPORT FPDF_DEST STDCALL FPDF_GetNamedDest(FPDF_DOCUMENT document,
|
| if (!pRoot)
|
| return nullptr;
|
|
|
| - CPDF_Object* pDestObj = NULL;
|
| + CPDF_Object* pDestObj = nullptr;
|
| CFX_ByteString bsName;
|
| CPDF_NameTree nameTree(pDoc, "Dests");
|
| int count = nameTree.GetCount();
|
| if (index >= count) {
|
| CPDF_Dictionary* pDest = pRoot->GetDict("Dests");
|
| if (!pDest)
|
| - return NULL;
|
| - if (index >= count + pDest->GetCount())
|
| - return NULL;
|
| + return nullptr;
|
| +
|
| + pdfium::base::CheckedNumeric<int> checked_count = count;
|
| + checked_count += pDest->GetCount();
|
| + if (!checked_count.IsValid() || index >= checked_count.ValueOrDie())
|
| + return nullptr;
|
| +
|
| index -= count;
|
| - FX_POSITION pos = pDest->GetStartPos();
|
| int i = 0;
|
| - while (pos) {
|
| - pDestObj = pDest->GetNextElement(pos, bsName);
|
| + for (const auto& it : *pDest) {
|
| + bsName = it.first;
|
| + pDestObj = it.second;
|
| if (!pDestObj)
|
| continue;
|
| if (i == index)
|
|
|