Check for more undefined behavior in CPDF_PSEngine.

core/fpdfapi/page/fpdf_page_func.cpp

Index: core/fpdfapi/page/fpdf_page_func.cpp
diff --git a/core/fpdfapi/page/fpdf_page_func.cpp b/core/fpdfapi/page/fpdf_page_func.cpp
index bf44a1e7c5666b49f9a3c4faff099c240ebf7018..7994659470b55ab59ce812fd78a40182a2aa63d7 100644
--- a/core/fpdfapi/page/fpdf_page_func.cpp
+++ b/core/fpdfapi/page/fpdf_page_func.cpp
@@ -20,7 +20,6 @@
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/cpdf_stream_acc.h"
 #include "core/fxcrt/fx_safe_types.h"
-#include "third_party/base/numerics/safe_conversions_impl.h"
 
 class CPDF_PSOP {
  public:
@@ -180,8 +179,11 @@ FX_BOOL CPDF_PSProc::Parse(CPDF_SimpleParser* parser, int depth) {
 }
 
 FX_BOOL CPDF_PSEngine::DoOperator(PDF_PSOP op) {
-  int i1, i2;
-  FX_FLOAT d1, d2;
+  int i1;
+  int i2;
+  FX_FLOAT d1;
+  FX_FLOAT d2;
+  FX_SAFE_INT32 result;
   switch (op) {
     case PSOP_ADD:
       d1 = Pop();
@@ -204,14 +206,26 @@ FX_BOOL CPDF_PSEngine::DoOperator(PDF_PSOP op) {
       Push(d1 / d2);
       break;
     case PSOP_IDIV:
-      i2 = (int)Pop();
-      i1 = (int)Pop();
-      Push(i2 ? i1 / i2 : 0);
+      i2 = static_cast<int>(Pop());
+      i1 = static_cast<int>(Pop());
+      if (i2) {
+        result = i1;
+        result /= i2;
+        Push(result.IsValid() ? result.ValueOrDie() : 0);
+      } else {

[Tom Sepez, 2016/10/12 16:08:42]

nit: ValueOrDefault(0)

[Lei Zhang, 2016/10/12 16:47:33]

Done.

+        Push(0);
+      }
       break;
     case PSOP_MOD:
-      i2 = (int)Pop();
-      i1 = (int)Pop();
-      Push(i2 ? i1 % i2 : 0);
+      i2 = static_cast<int>(Pop());
+      i1 = static_cast<int>(Pop());
+      if (i2) {
+        result = i1;
+        result %= i2;
+        Push(result.IsValid() ? result.ValueOrDie() : 0);
+      } else {
+        Push(0);
+      }
       break;
     case PSOP_NEG:
       d1 = Pop();