Use CompositeMask instead of TransferBitmap when drawing type 3 text

core/fpdfapi/render/fpdf_render_text.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/render/render_int.h"
 
 #include <vector>
 
@@ skipping 11 matching lines @@
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/render/cpdf_renderoptions.h"
 #include "core/fpdfapi/render/cpdf_textrenderer.h"
 #include "core/fpdfapi/render/cpdf_type3cache.h"
 #include "core/fxge/cfx_facecache.h"
 #include "core/fxge/cfx_fxgedevice.h"
 #include "core/fxge/cfx_gemodule.h"
 #include "core/fxge/cfx_graphstatedata.h"
 #include "core/fxge/cfx_pathdata.h"
 #include "core/fxge/cfx_renderdevice.h"
+#include "third_party/base/numerics/safe_math.h"
 
 FX_BOOL CPDF_RenderStatus::ProcessText(CPDF_TextObject* textobj,
                                        const CFX_Matrix* pObj2Device,
                                        CFX_PathData* pClippingPath) {
   if (textobj->m_nChars == 0)
     return TRUE;
 
   const TextRenderingMode text_render_mode = textobj->m_TextState.GetTextMode();
   if (text_render_mode == TextRenderingMode::MODE_INVISIBLE)
     return TRUE;
@@ skipping 265 matching lines @@
   CFX_DIBitmap bitmap;
   if (!bitmap.Create(static_cast<int>(rect.Width() * sa),
                      static_cast<int>(rect.Height() * sd), FXDIB_8bppMask)) {
     return TRUE;
   }
   bitmap.Clear(0);
   for (const FXTEXT_GLYPHPOS& glyph : glyphs) {
     if (!glyph.m_pGlyph)
       continue;
 
-    bitmap.TransferBitmap(
-        static_cast<int>(
-            (glyph.m_OriginX + glyph.m_pGlyph->m_Left - rect.left) * sa),
-        static_cast<int>((glyph.m_OriginY - glyph.m_pGlyph->m_Top - rect.top) *
-                         sd),
-        glyph.m_pGlyph->m_Bitmap.GetWidth(),
-        glyph.m_pGlyph->m_Bitmap.GetHeight(), &glyph.m_pGlyph->m_Bitmap, 0, 0);
+    pdfium::base::CheckedNumeric<int> left = glyph.m_OriginX;
+    left += glyph.m_pGlyph->m_Left;
+    left -= rect.left;
+    left *= sa;
+    if (!left.IsValid())
+      continue;
+
+    pdfium::base::CheckedNumeric<int> top = glyph.m_OriginY;
+    top -= glyph.m_pGlyph->m_Top;
+    top -= rect.top;
+    top *= sd;
+    if (!top.IsValid())
+      continue;
+
+    bitmap.CompositeMask(left.ValueOrDie(), top.ValueOrDie(),
+                         glyph.m_pGlyph->m_Bitmap.GetWidth(),
+                         glyph.m_pGlyph->m_Bitmap.GetHeight(),
+                         &glyph.m_pGlyph->m_Bitmap, fill_argb, 0, 0,
+                         FXDIB_BLEND_NORMAL, nullptr, FALSE, 0, nullptr);
   }
   m_pDevice->SetBitMask(&bitmap, rect.left, rect.top, fill_argb);
   return TRUE;
 }
 
 class CPDF_CharPosList {
  public:
   CPDF_CharPosList();
   ~CPDF_CharPosList();
   void Load(int nChars,
@@ skipping 305 matching lines @@
     matrix.Concat(font_size, 0, 0, font_size, charpos.m_OriginX,
                   charpos.m_OriginY);
     path.m_Path.Append(pPath, &matrix);
     path.m_Matrix = *pTextMatrix;
     path.m_bStroke = bStroke;
     path.m_FillType = bFill ? FXFILL_WINDING : 0;
     path.CalcBoundingBox();
     ProcessPath(&path, pObj2Device);
   }
 }