Attempt to fix potential integer overflow in CFX_FaceCache::LoadGlyphPath().

core/fxge/ge/cfx_facecache.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxge/include/cfx_facecache.h"
 
 #include <algorithm>
 
 #include "core/fxge/ge/fx_text_int.h"
 #include "core/fxge/include/cfx_fontmgr.h"
 #include "core/fxge/include/cfx_gemodule.h"
 #include "core/fxge/include/cfx_pathdata.h"
 #include "core/fxge/include/cfx_substfont.h"
 #include "core/fxge/include/fx_freetype.h"
 
 #ifdef _SKIA_SUPPORT_
 #include "third_party/skia/include/core/SkStream.h"
 #include "third_party/skia/include/core/SkTypeface.h"
 #endif
 
 namespace {
 
+constexpr uint32_t kInvalidGlyphIndex = static_cast<uint32_t>(-1);
+
 void GammaAdjust(uint8_t* pData,
                  int nHeight,
                  int src_pitch,
                  const uint8_t* gammaTable) {
   int count = nHeight * src_pitch;
   for (int i = 0; i < count; i++)
     pData[i] = gammaTable[pData[i]];
 }
 
 void ContrastAdjust(uint8_t* pDataIn,
@@ skipping 183 matching lines @@
       GammaAdjust(pDestBuf, bmheight, dest_pitch,
                   CFX_GEModule::Get()->GetTextGammaTable());
     }
   }
   return pGlyphBitmap;
 }
 
 const CFX_PathData* CFX_FaceCache::LoadGlyphPath(CFX_Font* pFont,
                                                  uint32_t glyph_index,
                                                  int dest_width) {
-  if (!m_Face || glyph_index == (uint32_t)-1)
+  if (!m_Face || glyph_index == kInvalidGlyphIndex || dest_width < 0)
     return nullptr;
 
   uint32_t key = glyph_index;
-  if (pFont->GetSubstFont()) {
-    key += (((pFont->GetSubstFont()->m_Weight / 16) << 15) +
-            ((pFont->GetSubstFont()->m_ItalicAngle / 2) << 21) +
-            ((dest_width / 16) << 25) + (pFont->IsVertical() << 31));
+  auto* pSubstFont = pFont->GetSubstFont();
+  if (pSubstFont) {
+    if (pSubstFont->m_Weight < 0 || pSubstFont->m_ItalicAngle < 0)
+      return nullptr;
+    uint32_t weight = static_cast<uint32_t>(pSubstFont->m_Weight);
+    uint32_t angle = static_cast<uint32_t>(pSubstFont->m_ItalicAngle);
+    uint32_t key_modifier = (weight / 16) << 15;
+    key_modifier += (angle / 2) << 21;
+    key_modifier += (static_cast<uint32_t>(dest_width) / 16) << 25;
+    if (pFont->IsVertical())
+      key_modifier += 1U << 31;
+    key += key_modifier;
   }
   auto it = m_PathMap.find(key);
   if (it != m_PathMap.end())
     return it->second.get();
 
   CFX_PathData* pGlyphPath = pFont->LoadGlyphPath(glyph_index, dest_width);
   m_PathMap[key] = std::unique_ptr<CFX_PathData>(pGlyphPath);
   return pGlyphPath;
 }
 
 const CFX_GlyphBitmap* CFX_FaceCache::LoadGlyphBitmap(CFX_Font* pFont,
                                                       uint32_t glyph_index,
                                                       FX_BOOL bFontStyle,
                                                       const CFX_Matrix* pMatrix,
                                                       int dest_width,
                                                       int anti_alias,
                                                       int& text_flags) {
-  if (glyph_index == (uint32_t)-1)
+  if (glyph_index == kInvalidGlyphIndex)
     return nullptr;
+
   _CFX_UniqueKeyGen keygen;
   int nMatrixA = static_cast<int>(pMatrix->a * 10000);
   int nMatrixB = static_cast<int>(pMatrix->b * 10000);
   int nMatrixC = static_cast<int>(pMatrix->c * 10000);
   int nMatrixD = static_cast<int>(pMatrix->d * 10000);
 #if _FXM_PLATFORM_ != _FXM_PLATFORM_APPLE_
   if (pFont->GetSubstFont()) {
     keygen.Generate(9, nMatrixA, nMatrixB, nMatrixC, nMatrixD, dest_width,
                     anti_alias, pFont->GetSubstFont()->m_Weight,
                     pFont->GetSubstFont()->m_ItalicAngle, pFont->IsVertical());
@@ skipping 110 matching lines @@
     return it2->second;
 
   CFX_GlyphBitmap* pGlyphBitmap = RenderGlyph(pFont, glyph_index, bFontStyle,
                                               pMatrix, dest_width, anti_alias);
   if (!pGlyphBitmap)
     return nullptr;
 
   pSizeCache->m_GlyphMap[glyph_index] = pGlyphBitmap;
   return pGlyphBitmap;
 }