Verify pattern start values.

core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_render/render_int.h"
 
 #include <algorithm>
 
@@ skipping 1120 matching lines @@
   for (int col = min_col; col <= max_col; col++) {
     for (int row = min_row; row <= max_row; row++) {
       int start_x, start_y;
       if (bAligned) {
         start_x = FXSYS_round(mtPattern2Device.e) + col * width - clip_box.left;
         start_y = FXSYS_round(mtPattern2Device.f) + row * height - clip_box.top;
       } else {
         FX_FLOAT orig_x = col * pPattern->x_step();
         FX_FLOAT orig_y = row * pPattern->y_step();
         mtPattern2Device.Transform(orig_x, orig_y);
-        start_x = FXSYS_round(orig_x + left_offset) - clip_box.left;
-        start_y = FXSYS_round(orig_y + top_offset) - clip_box.top;
+
+        pdfium::base::CheckedNumeric<int> safeStartX =
+            FXSYS_round(orig_x + left_offset);
+        pdfium::base::CheckedNumeric<int> safeStartY =
+            FXSYS_round(orig_y + top_offset);
+
+        safeStartX -= clip_box.left;
+        safeStartY -= clip_box.top;
+        if (!safeStartX.IsValid() || !safeStartY.IsValid())
+          return;
+
+        start_x = safeStartX.ValueOrDefault(0);

[Lei Zhang, 2016/09/07 21:44:32]

Can't these be ValueOrDie() since we know we won't die due to passing the checks
on line 1149?

+        start_y = safeStartY.ValueOrDefault(0);
       }
       if (width == 1 && height == 1) {
         if (start_x < 0 || start_x >= clip_box.Width() || start_y < 0 ||
             start_y >= clip_box.Height()) {
           continue;
         }
         uint32_t* dest_buf =
             (uint32_t*)(screen.GetBuffer() + screen.GetPitch() * start_y +
                         start_x * 4);
         if (pPattern->colored())
@@ skipping 42 matching lines @@
     }
   }
   if (bStroke) {
     const CPDF_Color& StrokeColor = *pPathObj->m_ColorState.GetStrokeColor();
     if (StrokeColor.IsPattern()) {
       DrawPathWithPattern(pPathObj, pObj2Device, &StrokeColor, TRUE);
       bStroke = FALSE;
     }
   }
 }