| Index: fpdfsdk/src/fpdfview.cpp
|
| diff --git a/fpdfsdk/src/fpdfview.cpp b/fpdfsdk/src/fpdfview.cpp
|
| index e047b50846ab0991587902cb0c732b2e07026fb2..a6c14206cece327a501103c86e1b500694979749 100644
|
| --- a/fpdfsdk/src/fpdfview.cpp
|
| +++ b/fpdfsdk/src/fpdfview.cpp
|
| @@ -1049,11 +1049,15 @@ DLLEXPORT FPDF_DWORD STDCALL FPDF_CountNamedDests(FPDF_DOCUMENT document) {
|
| return 0;
|
|
|
| CPDF_NameTree nameTree(pDoc, "Dests");
|
| - int count = nameTree.GetCount();
|
| + pdfium::base::CheckedNumeric<FPDF_DWORD> count = nameTree.GetCount();
|
| CPDF_Dictionary* pDest = pRoot->GetDict("Dests");
|
| if (pDest)
|
| count += pDest->GetCount();
|
| - return count;
|
| +
|
| + if (!count.IsValid())
|
| + return 0;
|
| +
|
| + return count.ValueOrDie();
|
| }
|
|
|
| DLLEXPORT FPDF_DEST STDCALL FPDF_GetNamedDestByName(FPDF_DOCUMENT document,
|
| @@ -1141,21 +1145,25 @@ DLLEXPORT FPDF_DEST STDCALL FPDF_GetNamedDest(FPDF_DOCUMENT document,
|
| if (!pRoot)
|
| return nullptr;
|
|
|
| - CPDF_Object* pDestObj = NULL;
|
| + CPDF_Object* pDestObj = nullptr;
|
| CFX_ByteString bsName;
|
| CPDF_NameTree nameTree(pDoc, "Dests");
|
| int count = nameTree.GetCount();
|
| if (index >= count) {
|
| CPDF_Dictionary* pDest = pRoot->GetDict("Dests");
|
| if (!pDest)
|
| - return NULL;
|
| - if (index >= count + pDest->GetCount())
|
| - return NULL;
|
| + return nullptr;
|
| +
|
| + pdfium::base::CheckedNumeric<int> checked_count = count;
|
| + checked_count += pDest->GetCount();
|
| + if (!checked_count.IsValid() || index >= checked_count.ValueOrDie())
|
| + return nullptr;
|
| +
|
| index -= count;
|
| - FX_POSITION pos = pDest->GetStartPos();
|
| int i = 0;
|
| - while (pos) {
|
| - pDestObj = pDest->GetNextElement(pos, bsName);
|
| + for (const auto& it : *pDest) {
|
| + bsName = it.first;
|
| + pDestObj = it.second;
|
| if (!pDestObj)
|
| continue;
|
| if (i == index)
|
|
|