Use CompositeMask instead of TransferBitmap when drawing type 3 text

core/fpdfapi/render/fpdf_render_text.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/render/render_int.h"
 
 #include <vector>
 
@@ skipping 257 matching lines @@
         m_pDevice->SetDIBits(bitmap_device.GetBitmap(), rect.left, rect.top);
       }
       delete pStates;
     } else if (pType3Char->m_pBitmap) {
       if (device_class == FXDC_DISPLAY) {
         CPDF_Type3Cache* pCache = GetCachedType3(pType3Font);
         refTypeCache.m_dwCount++;
         CFX_GlyphBitmap* pBitmap = pCache->LoadGlyph(charcode, &matrix, sa, sd);
         if (!pBitmap)
           continue;
-
         int origin_x = FXSYS_round(matrix.e);
         int origin_y = FXSYS_round(matrix.f);
         if (glyphs.empty()) {
           m_pDevice->SetBitMask(&pBitmap->m_Bitmap, origin_x + pBitmap->m_Left,
                                 origin_y - pBitmap->m_Top, fill_argb);
         } else {
           glyphs[iChar].m_pGlyph = pBitmap;
           glyphs[iChar].m_OriginX = origin_x;
           glyphs[iChar].m_OriginY = origin_y;
         }
       } else {
         CFX_Matrix image_matrix = pType3Char->m_ImageMatrix;
         image_matrix.Concat(matrix);
         CPDF_ImageRenderer renderer;
         if (renderer.Start(this, pType3Char->m_pBitmap.get(), fill_argb, 255,
                            &image_matrix, 0, FALSE)) {
           renderer.Continue(nullptr);
         }
         if (!renderer.m_Result)
           return FALSE;
       }
     }
   }
 
   if (glyphs.empty())
     return TRUE;
-
   FX_RECT rect = FXGE_GetGlyphsBBox(glyphs, 0, sa, sd);
   CFX_DIBitmap bitmap;
   if (!bitmap.Create(static_cast<int>(rect.Width() * sa),
                      static_cast<int>(rect.Height() * sd), FXDIB_8bppMask)) {
     return TRUE;
   }
   bitmap.Clear(0);
   for (const FXTEXT_GLYPHPOS& glyph : glyphs) {
     if (!glyph.m_pGlyph)
       continue;
 
-    bitmap.TransferBitmap(
-        static_cast<int>(
-            (glyph.m_OriginX + glyph.m_pGlyph->m_Left - rect.left) * sa),
-        static_cast<int>((glyph.m_OriginY - glyph.m_pGlyph->m_Top - rect.top) *
-                         sd),
-        glyph.m_pGlyph->m_Bitmap.GetWidth(),
-        glyph.m_pGlyph->m_Bitmap.GetHeight(), &glyph.m_pGlyph->m_Bitmap, 0, 0);
+    pdfium::base::CheckedNumeric<int> left = glyph.m_OriginX;

[Lei Zhang, 2016/10/28 18:58:20]

nit: include the header for CheckedNumeric.

[npm, 2016/10/28 19:26:25]

Done.

+    left += glyph.m_pGlyph->m_Left;
+    left -= rect.left;
+    left *= sa;
+    if (!left.IsValid())
+      continue;
+
+    pdfium::base::CheckedNumeric<int> top = glyph.m_OriginY;
+    top -= glyph.m_pGlyph->m_Top;
+    top -= rect.top;
+    top *= sd;
+    if (!top.IsValid())
+      continue;
+
+    bitmap.CompositeMask(left.ValueOrDie(), top.ValueOrDie(),
+                         glyph.m_pGlyph->m_Bitmap.GetWidth(),
+                         glyph.m_pGlyph->m_Bitmap.GetHeight(),
+                         &glyph.m_pGlyph->m_Bitmap, fill_argb, 0, 0,
+                         FXDIB_BLEND_NORMAL, nullptr, FALSE, 0, nullptr);
   }
   m_pDevice->SetBitMask(&bitmap, rect.left, rect.top, fill_argb);
   return TRUE;
 }
 
 class CPDF_CharPosList {
  public:
   CPDF_CharPosList();
   ~CPDF_CharPosList();
   void Load(int nChars,
@@ skipping 305 matching lines @@
     matrix.Concat(font_size, 0, 0, font_size, charpos.m_OriginX,
                   charpos.m_OriginY);
     path.m_Path.Append(pPath, &matrix);
     path.m_Matrix = *pTextMatrix;
     path.m_bStroke = bStroke;
     path.m_FillType = bFill ? FXFILL_WINDING : 0;
     path.CalcBoundingBox();
     ProcessPath(&path, pObj2Device);
   }
 }