Check for more undefined behavior in CPDF_PSEngine.

core/fpdfapi/page/fpdf_page_func.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/page/pageint.h"
 
 #include <limits.h>
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 #include <vector>
 
 #include "core/fpdfapi/page/cpdf_psengine.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_simple_parser.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/cpdf_stream_acc.h"
 #include "core/fxcrt/fx_safe_types.h"
-#include "third_party/base/numerics/safe_conversions_impl.h"
 
 class CPDF_PSOP {
  public:
   explicit CPDF_PSOP(PDF_PSOP op) : m_op(op), m_value(0) {
     ASSERT(m_op != PSOP_CONST);
     ASSERT(m_op != PSOP_PROC);
   }
   explicit CPDF_PSOP(FX_FLOAT value) : m_op(PSOP_CONST), m_value(value) {}
   explicit CPDF_PSOP(std::unique_ptr<CPDF_PSProc> proc)
       : m_op(PSOP_PROC), m_value(0), m_proc(std::move(proc)) {}
@@ skipping 139 matching lines @@
       }
       if (!found) {
         std::unique_ptr<CPDF_PSOP> op(new CPDF_PSOP(FX_atof(word)));
         m_Operators.push_back(std::move(op));
       }
     }
   }
 }
 
 FX_BOOL CPDF_PSEngine::DoOperator(PDF_PSOP op) {
-  int i1, i2;
-  FX_FLOAT d1, d2;
+  int i1;
+  int i2;
+  FX_FLOAT d1;
+  FX_FLOAT d2;
+  FX_SAFE_INT32 result;
   switch (op) {
     case PSOP_ADD:
       d1 = Pop();
       d2 = Pop();
       Push(d1 + d2);
       break;
     case PSOP_SUB:
       d2 = Pop();
       d1 = Pop();
       Push(d1 - d2);
       break;
     case PSOP_MUL:
       d1 = Pop();
       d2 = Pop();
       Push(d1 * d2);
       break;
     case PSOP_DIV:
       d2 = Pop();
       d1 = Pop();
       Push(d1 / d2);
       break;
     case PSOP_IDIV:
-      i2 = (int)Pop();
-      i1 = (int)Pop();
-      Push(i2 ? i1 / i2 : 0);
+      i2 = static_cast<int>(Pop());
+      i1 = static_cast<int>(Pop());
+      if (i2) {
+        result = i1;
+        result /= i2;
+        Push(result.IsValid() ? result.ValueOrDie() : 0);
+      } else {

[Tom Sepez, 2016/10/12 16:08:42]

nit: ValueOrDefault(0)

[Lei Zhang, 2016/10/12 16:47:33]

Done.

+        Push(0);
+      }
       break;
     case PSOP_MOD:
-      i2 = (int)Pop();
-      i1 = (int)Pop();
-      Push(i2 ? i1 % i2 : 0);
+      i2 = static_cast<int>(Pop());
+      i1 = static_cast<int>(Pop());
+      if (i2) {
+        result = i1;
+        result %= i2;
+        Push(result.IsValid() ? result.ValueOrDie() : 0);
+      } else {
+        Push(0);
+      }
       break;
     case PSOP_NEG:
       d1 = Pop();
       Push(-d1);
       break;
     case PSOP_ABS:
       d1 = Pop();
       Push((FX_FLOAT)FXSYS_fabs(d1));
       break;
     case PSOP_CEILING:
@@ skipping 611 matching lines @@
   return m_Type == Type::kType2ExpotentialInterpolation
              ? static_cast<const CPDF_ExpIntFunc*>(this)
              : nullptr;
 }
 
 const CPDF_StitchFunc* CPDF_Function::ToStitchFunc() const {
   return m_Type == Type::kType3Stitching
              ? static_cast<const CPDF_StitchFunc*>(this)
              : nullptr;
 }