Fix integer issues leading to out of bounds access in fx_ge_text.cpp.

core/fxge/ge/fx_ge_text.cpp

Index: core/fxge/ge/fx_ge_text.cpp
diff --git a/core/fxge/ge/fx_ge_text.cpp b/core/fxge/ge/fx_ge_text.cpp
index 44ab9f7ab51899fdff23cf38138e05f2bffb06e5..470c590c00f41283a884250608a3054d9d733f34 100644
--- a/core/fxge/ge/fx_ge_text.cpp
+++ b/core/fxge/ge/fx_ge_text.cpp
@@ -4,6 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
+#include <limits>
+
 #include "core/fxcodec/include/fx_codec.h"
 #include "core/fxge/ge/fx_text_int.h"
 #include "core/fxge/include/fx_freetype.h"
@@ -1568,9 +1570,12 @@ CFX_GlyphBitmap* CFX_FaceCache::RenderGlyph(CFX_Font* pFont,
     }
     if (skew) {
       // skew is nonpositive so -skew is used as the index.
-      skew = -skew <= static_cast<int>(ANGLESKEW_ARRAY_SIZE)
-                 ? -58
-                 : -g_AngleSkew[-skew];
+      if (skew < 0 && skew != std::numeric_limits<int>::min() &&
+          static_cast<size_t>(-skew) < ANGLESKEW_ARRAY_SIZE) {

[Wei Li, 2016/04/11 16:40:37]

/skew < 0/skew <= 0/

Also, casting to size_t makes -INT_MIN a very large unsigned value, so the
comparison with min() is not needed. In fact, even "skew<=0" could be skipped
too.

[Oliver Chang, 2016/04/11 16:51:42]

Done. 
The issue is that -INT_MIN is undefined, and I want to avoid invoking undefined
behaviour. It seems fine to me to keep the <= 0 check though to be on the safe
side, as it should be a pretty cheap check?

+        skew = -g_AngleSkew[-skew];
+      } else {
+        skew = -58;
+      }
       if (pFont->IsVertical())
         ft_matrix.yx += ft_matrix.yy * skew / 100;
       else
@@ -1834,9 +1839,12 @@ CFX_PathData* CFX_Font::LoadGlyphPath(uint32_t glyph_index, int dest_width) {
     if (m_pSubstFont->m_ItalicAngle) {
       int skew = m_pSubstFont->m_ItalicAngle;
       // skew is nonpositive so -skew is used as the index.
-      skew = -skew <= static_cast<int>(ANGLESKEW_ARRAY_SIZE)
-                 ? -58
-                 : -g_AngleSkew[-skew];
+      if (skew < 0 && skew != std::numeric_limits<int>::min() &&

[Wei Li, 2016/04/11 17:00:47]

skew <= 0 here too.

Since you are here, can you pls change the comments in both places as well?
"skew should be non-positive so -skew can be used as the index. Also skew should
not be INT_MIN to avoid integer overflow." or sth like this. Thanks.

[Oliver Chang, 2016/04/11 17:06:47]

Already made this <= 0 too. Added the comment

+          static_cast<size_t>(-skew) < ANGLESKEW_ARRAY_SIZE) {
+        skew = -g_AngleSkew[-skew];
+      } else {
+        skew = -58;
+      }
       if (m_bVertical)
         ft_matrix.yx += ft_matrix.yy * skew / 100;
       else