Fix an uninitalized read in FPDFText_GetFontSize().

core/src/fpdftext/fpdf_text_int.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <algorithm>
 #include <cctype>
 #include <cwctype>
 #include <memory>
@@ skipping 59 matching lines @@
         bAllChar = FALSE;
       }
     }
     if (baseSpace < 0.0 || (nItems == 3 && !bAllChar)) {
       baseSpace = 0.0;
     }
   }
   return baseSpace;
 }
 
+const FX_FLOAT kDefaultFontSize = 1;

[jun_fang, 2016/01/09 08:38:56]

nit: Replace 1 with 1.0f.

[Lei Zhang, 2016/01/11 19:44:43]

Done.

+
 }  // namespace
 
 CPDFText_ParseOptions::CPDFText_ParseOptions()
     : m_bGetCharCodeOnly(FALSE),
       m_bNormalizeObjs(TRUE),
       m_bOutputHyphen(FALSE) {}
 
 IPDF_TextPage* IPDF_TextPage::CreateTextPage(const CPDF_Page* pPage,
                                              int flags) {
   return new CPDF_TextPage(pPage, flags);
@@ skipping 361 matching lines @@
 int CPDF_TextPage::GetIndexAtPos(FX_FLOAT x,
                                  FX_FLOAT y,
                                  FX_FLOAT xTolerance,
                                  FX_FLOAT yTolerance) const {
   if (m_ParseOptions.m_bGetCharCodeOnly) {
     return -3;
   }
   CPDF_Point point(x, y);
   return GetIndexAtPos(point, xTolerance, yTolerance);
 }
-void CPDF_TextPage::GetCharInfo(int index, FPDF_CHAR_INFO& info) const {
+
+void CPDF_TextPage::GetCharInfo(int index, FPDF_CHAR_INFO* info) const {
   if (m_ParseOptions.m_bGetCharCodeOnly || !m_bIsParsed)
     return;
 
   if (index < 0 || index >= m_charList.GetSize())
     return;
 
-  PAGECHAR_INFO charinfo;
-  charinfo = *(PAGECHAR_INFO*)m_charList.GetAt(index);
-  info.m_Charcode = charinfo.m_CharCode;
-  info.m_OriginX = charinfo.m_OriginX;
-  info.m_OriginY = charinfo.m_OriginY;
-  info.m_Unicode = charinfo.m_Unicode;
-  info.m_Flag = charinfo.m_Flag;
-  info.m_CharBox = charinfo.m_CharBox;
-  info.m_pTextObj = charinfo.m_pTextObj;
-  if (charinfo.m_pTextObj && charinfo.m_pTextObj->GetFont()) {
-    info.m_FontSize = charinfo.m_pTextObj->GetFontSize();
+  const PAGECHAR_INFO* charinfo =
+      static_cast<PAGECHAR_INFO*>(m_charList.GetAt(index));
+  info->m_Charcode = charinfo->m_CharCode;
+  info->m_OriginX = charinfo->m_OriginX;
+  info->m_OriginY = charinfo->m_OriginY;
+  info->m_Unicode = charinfo->m_Unicode;
+  info->m_Flag = charinfo->m_Flag;
+  info->m_CharBox = charinfo->m_CharBox;
+  info->m_pTextObj = charinfo->m_pTextObj;
+  if (charinfo->m_pTextObj && charinfo->m_pTextObj->GetFont()) {
+    info->m_FontSize = charinfo->m_pTextObj->GetFontSize();
+  } else {
+    info->m_FontSize = kDefaultFontSize;
   }
-  info.m_Matrix.Copy(charinfo.m_Matrix);
-  return;
+  info->m_Matrix.Copy(charinfo->m_Matrix);
 }
+
 void CPDF_TextPage::CheckMarkedContentObject(int32_t& start,
                                              int32_t& nCount) const {
   PAGECHAR_INFO charinfo = *(PAGECHAR_INFO*)m_charList.GetAt(start);
   PAGECHAR_INFO charinfo2 =
       *(PAGECHAR_INFO*)m_charList.GetAt(start + nCount - 1);
   if (FPDFTEXT_CHAR_PIECE != charinfo.m_Flag &&
       FPDFTEXT_CHAR_PIECE != charinfo2.m_Flag) {
     return;
   }
   if (FPDFTEXT_CHAR_PIECE == charinfo.m_Flag) {
@@ skipping 94 matching lines @@
     return;
 
   if (rectIndex < 0 || rectIndex >= m_SelRects.GetSize())
     return;
 
   left = m_SelRects.GetAt(rectIndex).left;
   top = m_SelRects.GetAt(rectIndex).top;
   right = m_SelRects.GetAt(rectIndex).right;
   bottom = m_SelRects.GetAt(rectIndex).bottom;
 }
+
 FX_BOOL CPDF_TextPage::GetBaselineRotate(int start, int end, int& Rotate) {
   if (m_ParseOptions.m_bGetCharCodeOnly) {
     return FALSE;
   }
   if (end == start) {
     return FALSE;
   }
-  FX_FLOAT dx, dy;
-  FPDF_CHAR_INFO info1, info2;
-  GetCharInfo(start, info1);
-  GetCharInfo(end, info2);
-  while (info2.m_CharBox.Width() == 0 || info2.m_CharBox.Height() == 0) {
-    end--;
-    if (end <= start) {
+  FPDF_CHAR_INFO info_start;
+  FPDF_CHAR_INFO info_end;
+  GetCharInfo(start, &info_start);
+  GetCharInfo(end, &info_end);
+  while (info_end.m_CharBox.Width() == 0 || info_end.m_CharBox.Height() == 0) {
+    if (--end <= start)
       return FALSE;
-    }
-    GetCharInfo(end, info2);
+
+    GetCharInfo(end, &info_end);
   }
-  dx = (info2.m_OriginX - info1.m_OriginX);
-  dy = (info2.m_OriginY - info1.m_OriginY);
+  FX_FLOAT dx = (info_end.m_OriginX - info_start.m_OriginX);
+  FX_FLOAT dy = (info_end.m_OriginY - info_start.m_OriginY);
   if (dx == 0) {
     if (dy > 0) {
       Rotate = 90;
     } else if (dy < 0) {
       Rotate = 270;
     } else {
       Rotate = 0;
     }
   } else {
     float a = FXSYS_atan2(dy, dx);
     Rotate = (int)(a * 180 / FX_PI + 0.5);
   }
   if (Rotate < 0) {
     Rotate = -Rotate;
   } else if (Rotate > 0) {
     Rotate = 360 - Rotate;
   }
   return TRUE;
 }
+
 FX_BOOL CPDF_TextPage::GetBaselineRotate(const CFX_FloatRect& rect,
                                          int& Rotate) {
   if (m_ParseOptions.m_bGetCharCodeOnly) {
     return FALSE;
   }
   int start, end, count,
       n = CountBoundedSegments(rect.left, rect.top, rect.right, rect.bottom,
                                TRUE);
   if (n < 1) {
     return FALSE;
@@ skipping 1400 matching lines @@
     if (pObj->m_Type != PDFPAGE_TEXT) {
       continue;
     }
     if (IsSameTextObject((CPDF_TextObject*)pObj, pTextObj)) {
       return TRUE;
     }
     i++;
   }
   return FALSE;
 }
+
 FX_BOOL CPDF_TextPage::GenerateCharInfo(FX_WCHAR unicode, PAGECHAR_INFO& info) {
   int size = m_TempCharList.GetSize();
   PAGECHAR_INFO preChar;
   if (size) {
     preChar = (PAGECHAR_INFO)m_TempCharList[size - 1];
   } else {
     size = m_charList.GetSize();
     if (size == 0) {
       return FALSE;
     }
     preChar = (PAGECHAR_INFO)m_charList[size - 1];
   }
   info.m_Index = m_TextBuf.GetLength();
   info.m_Unicode = unicode;
   info.m_pTextObj = NULL;
   info.m_CharCode = -1;
   info.m_Flag = FPDFTEXT_CHAR_GENERATED;
   int preWidth = 0;
-  if (preChar.m_pTextObj && preChar.m_CharCode != (FX_DWORD)-1) {
+  if (preChar.m_pTextObj && preChar.m_CharCode != (FX_DWORD)-1)
     preWidth = GetCharWidth(preChar.m_CharCode, preChar.m_pTextObj->GetFont());
-  }
-  FX_FLOAT fs = 0;
-  if (preChar.m_pTextObj) {
-    fs = preChar.m_pTextObj->GetFontSize();
-  } else {
-    fs = preChar.m_CharBox.Height();
-  }
-  if (!fs) {
-    fs = 1;
-  }
-  info.m_OriginX = preChar.m_OriginX + preWidth * (fs) / 1000;
+
+  FX_FLOAT fFontSize = preChar.m_pTextObj ? preChar.m_pTextObj->GetFontSize()
+                                          : preChar.m_CharBox.Height();
+  if (!fFontSize)
+    fFontSize = kDefaultFontSize;
+
+  info.m_OriginX = preChar.m_OriginX + preWidth * (fFontSize) / 1000;
   info.m_OriginY = preChar.m_OriginY;
   info.m_CharBox = CFX_FloatRect(info.m_OriginX, info.m_OriginY, info.m_OriginX,
                                  info.m_OriginY);
   return TRUE;
 }
+
 FX_BOOL CPDF_TextPage::IsRectIntersect(const CFX_FloatRect& rect1,
                                        const CFX_FloatRect& rect2) {
   CFX_FloatRect rect = rect1;
   rect.Intersect(rect2);
   return !rect.IsEmpty();
 }
 FX_BOOL CPDF_TextPage::IsLetter(FX_WCHAR unicode) {
   if (unicode < L'A') {
     return FALSE;
   }
@@ skipping 15 matching lines @@
       m_resStart(0),
       m_resEnd(-1),
       m_IsFind(FALSE) {
   m_strText = m_pTextPage->GetPageText();
   int nCount = pTextPage->CountChars();
   if (nCount) {
     m_CharIndex.Add(0);
   }
   for (int i = 0; i < nCount; i++) {
     FPDF_CHAR_INFO info;
-    pTextPage->GetCharInfo(i, info);
+    pTextPage->GetCharInfo(i, &info);
     int indexSize = m_CharIndex.GetSize();
     if (info.m_Flag == CHAR_NORMAL || info.m_Flag == CHAR_GENERATED) {
       if (indexSize % 2) {
         m_CharIndex.Add(1);
       } else {
         if (indexSize <= 0) {
           continue;
         }
         m_CharIndex.SetAt(indexSize - 1, m_CharIndex.GetAt(indexSize - 1) + 1);
       }
@@ skipping 405 matching lines @@
   if (!m_bIsParsed) {
     return -1;
   }
   return m_LinkList.GetSize();
 }
 void CPDF_LinkExtract::ParseLink() {
   int start = 0, pos = 0;
   int TotalChar = m_pTextPage->CountChars();
   while (pos < TotalChar) {
     FPDF_CHAR_INFO pageChar;
-    m_pTextPage->GetCharInfo(pos, pageChar);
+    m_pTextPage->GetCharInfo(pos, &pageChar);
     if (pageChar.m_Flag == CHAR_GENERATED || pageChar.m_Unicode == 0x20 ||
         pos == TotalChar - 1) {
       int nCount = pos - start;
       if (pos == TotalChar - 1) {
         nCount++;
       }
       CFX_WideString strBeCheck;
       strBeCheck = m_pTextPage->GetPageText(start, nCount);
       if (strBeCheck.GetLength() > 5) {
         while (strBeCheck.GetLength() > 0) {
@@ skipping 150 matching lines @@
   if (!m_bIsParsed || index < 0 || index >= m_LinkList.GetSize()) {
     return;
   }
   CPDF_LinkExt* link = NULL;
   link = m_LinkList.GetAt(index);
   if (!link) {
     return;
   }
   m_pTextPage->GetRectArray(link->m_Start, link->m_Count, rects);
 }