Check path point count overflow in DrawThisAppearance

fpdfsdk/src/pdfwindow/PWL_Edit.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/pdfwindow/PDFWindow.h"
 #include "../../include/pdfwindow/PWL_Wnd.h"
 #include "../../include/pdfwindow/PWL_EditCtrl.h"
 #include "../../include/pdfwindow/PWL_Edit.h"
@@ skipping 393 matching lines @@
 }
 
 void CPWL_Edit::DrawThisAppearance(CFX_RenderDevice* pDevice, CPDF_Matrix* pUser2Device)
 {
         CPWL_Wnd::DrawThisAppearance(pDevice,pUser2Device);
 
         CPDF_Rect rcClient = GetClientRect();
         CFX_ByteTextBuf sLine;
 
         FX_INT32 nCharArray = m_pEdit->GetCharArray();
+        FX_SAFE_INT32 nCharArrayDouble = nCharArray;

[Tom Sepez, 2014/08/18 18:15:47]

nit: Can we call this nCharArraySafe?  Double sounds too much like a
floating-point type, even though what you mean is that this value "doubles" the
other as a stand-in for it.

[Bo Xu, 2014/08/18 18:33:58]

Done.

+        nCharArrayDouble -= 1;
+        nCharArrayDouble *= 2;
 
-        if (nCharArray > 0)
+        if (nCharArray > 0 && nCharArrayDouble.IsValid())
         {
                 switch (GetBorderStyle())
                 {
                 case PBS_SOLID:
                         {
                                 CFX_GraphStateData gsd;
                                 gsd.m_LineWidth = (FX_FLOAT)GetBorderWidth();
 
                                 CFX_PathData path;
-                                path.SetPointCount((nCharArray-1)*2);
+                                if (!path.SetPointCount(nCharArrayDouble.ValueOrDie())) {
+                                        return;
+                                }
                                 
                                 for (FX_INT32 i=0; i<nCharArray-1; i++)
                                 {                                       
                                         path.SetPoint(i*2, rcClient.left + ((rcClient.right - rcClient.left)/nCharArray)*(i+1), 
                                                 rcClient.bottom, FXPT_MOVETO);
                                         path.SetPoint(i*2+1, rcClient.left + ((rcClient.right - rcClient.left)/nCharArray)*(i+1),
                                                 rcClient.top, FXPT_LINETO);                                                                                     
                                 }                       
                                 if (path.GetPointCount() > 0)
                                         pDevice->DrawPath(&path, pUser2Device, &gsd,0,  
                                                 CPWL_Utils::PWLColorToFXColor(GetBorderColor(),255), FXFILL_ALTERNATE);
                         }
                         break; 
                 case PBS_DASH:
                         {
                                 CFX_GraphStateData gsd;
                                 gsd.m_LineWidth = (FX_FLOAT)GetBorderWidth();
 
                                 gsd.SetDashCount(2);
                                 gsd.m_DashArray[0] = (FX_FLOAT)GetBorderDash().nDash;
                                 gsd.m_DashArray[1] = (FX_FLOAT)GetBorderDash().nGap;
                                 gsd.m_DashPhase = (FX_FLOAT)GetBorderDash().nPhase;
 
                                 CFX_PathData path;
-                                path.SetPointCount((nCharArray-1)*2);
+                                if (!path.SetPointCount(nCharArrayDouble.ValueOrDie())) {
+                                        return;
+                                }
                                 
                                 for (FX_INT32 i=0; i<nCharArray-1; i++)
                                 {                                       
                                         path.SetPoint(i*2, rcClient.left + ((rcClient.right - rcClient.left)/nCharArray)*(i+1), 
                                                 rcClient.bottom, FXPT_MOVETO);
                                         path.SetPoint(i*2+1, rcClient.left + ((rcClient.right - rcClient.left)/nCharArray)*(i+1),
                                                 rcClient.top, FXPT_LINETO);                                                                                     
                                 }               
                                 if (path.GetPointCount() > 0)
                                         pDevice->DrawPath(&path, pUser2Device, &gsd,0,  
@@ skipping 846 matching lines @@
         IFX_Edit::GeneratePageObjects(pPageObjects, m_pEdit, ptOffset, NULL, CPWL_Utils::PWLColorToFXColor(GetTextColor(),GetTransparency()), ObjArray);
 }
 
 void CPWL_Edit::GeneratePageObjects(CPDF_PageObjects* pPageObjects, 
                                                                         const CPDF_Point& ptOffset)
 {
         CFX_ArrayTemplate<CPDF_TextObject*> ObjArray;
         IFX_Edit::GeneratePageObjects(pPageObjects, m_pEdit, ptOffset, NULL, CPWL_Utils::PWLColorToFXColor(GetTextColor(),GetTransparency()), ObjArray);
 }