Bounds check in CFX_Font::LoadGlyphPath().

core/src/fxge/ge/fx_ge_text.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxge/fx_freetype.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "text_int.h"
@@ skipping 1208 matching lines @@
         int max_width = FXFT_Get_Glyph_HoriAdvance(m_Face) * 1000 / FXFT_Get_Face_UnitsPerEM(m_Face);
         if (max_width == min_width) {
             return;
         }
         int param = min_param + (max_param - min_param) * (dest_width - min_width) / (max_width - min_width);
         coords[1] = param;
     }
     FXFT_Free(m_Face, pMasters);
     FXFT_Set_MM_Design_Coordinates(m_Face, 2, coords);
 }
-extern const char g_AngleSkew[30] = {
+static const size_t ANGLESKEW_ARRAY_SIZE = 30;
+static const char g_AngleSkew[ANGLESKEW_ARRAY_SIZE] = {
     0, 2, 3, 5, 7, 9, 11, 12, 14, 16,
     18, 19, 21, 23, 25, 27, 29, 31, 32, 34,
     36, 38, 40, 42, 45, 47, 49, 51, 53, 55,
 };
-static const FX_BYTE g_WeightPow[100] = {
+static const size_t WEIGHTPOW_ARRAY_SIZE = 100;
+static const FX_BYTE g_WeightPow[WEIGHTPOW_ARRAY_SIZE] = {
     0, 3, 6, 7, 8, 9, 11, 12, 14, 15, 16, 17, 18, 19, 20,
     21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 35, 36, 36,
     37, 37, 37, 38, 38, 38, 39, 39, 39, 40, 40, 40, 41, 41, 41, 42, 42, 42,
     42, 43, 43, 43, 44, 44, 44, 44, 45, 45, 45, 45, 46, 46, 46, 46, 47, 47,
     47, 47, 48, 48, 48, 48, 48, 49, 49, 49, 49, 50, 50, 50, 50, 50, 51, 51,
     51, 51, 51, 52, 52, 52, 52, 52, 53, 53, 53, 53, 53,
 };
-extern const FX_BYTE g_WeightPow_11[100] = {
+static const FX_BYTE g_WeightPow_11[WEIGHTPOW_ARRAY_SIZE] = {
     0, 4, 7, 8, 9, 10, 12, 13, 15, 17, 18, 19, 20, 21, 22,
     23, 24, 25, 26, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 39, 39, 40, 40,
     41, 41, 41, 42, 42, 42, 43, 43, 43, 44, 44, 44, 45, 45, 45, 46, 46, 46,
     46, 43, 47, 47, 48, 48, 48, 48, 45, 50, 50, 50, 46, 51, 51, 51, 52, 52,
     52, 52, 53, 53, 53, 53, 53, 54, 54, 54, 54, 55, 55, 55, 55, 55, 56, 56,
     56, 56, 56, 57, 57, 57, 57, 57, 58, 58, 58, 58, 58,
 };
-extern const FX_BYTE g_WeightPow_SHIFTJIS[100] = {
+static const FX_BYTE g_WeightPow_SHIFTJIS[WEIGHTPOW_ARRAY_SIZE] = {
     0, 0, 1, 2, 3, 4, 5, 7, 8, 10, 11, 13, 14, 16, 17, 19, 21, 22, 24, 26, 28,
     30, 32, 33, 35, 37, 39, 41, 43, 45, 48, 48, 48, 48, 49, 49, 49, 50, 50, 50, 50,
     51, 51, 51, 51, 52, 52, 52, 52, 52, 53, 53, 53, 53, 53, 54, 54, 54, 54, 54, 55, 55,
     55, 55, 55, 56, 56, 56, 56, 56 , 56, 57, 57, 57 , 57 , 57, 57, 57, 58, 58, 58, 58, 58,
     58, 58, 59, 59, 59, 59, 59, 59, 59, 60, 60, 60, 60, 60, 60, 60, 60,
 };
 static void _GammaAdjust(FX_LPBYTE pData, int nWid, int nHei, int src_pitch, FX_LPCBYTE gammaTable)
 {
     int count = nHei * src_pitch;
     for(int i = 0; i < count; i++) {
@@ skipping 55 matching lines @@
     const CFX_SubstFont* pSubstFont = pFont->GetSubstFont();
     if (pSubstFont) {
         bUseCJKSubFont = pSubstFont->m_bSubstOfCJK && bFontStyle;
         int skew = 0;
         if (bUseCJKSubFont) {
             skew = pSubstFont->m_bItlicCJK ? -15 : 0;
         } else {
             skew = pSubstFont->m_ItalicAngle;
         }
         if (skew) {
-            skew = skew <= -30 ? -58 : -g_AngleSkew[-skew];
+            skew = skew <= -ANGLESKEW_ARRAY_SIZE ? -58 : -g_AngleSkew[-skew];
             if (pFont->IsVertical()) {
                 ft_matrix.yx += ft_matrix.yy * skew / 100;
             } else {
                 ft_matrix.xy += -ft_matrix.xx * skew / 100;
             }
         }
         if (pSubstFont->m_SubstFlags & FXFONT_SUBST_MM) {
             pFont->AdjustMMParams(glyph_index, dest_width, pFont->GetSubstFont()->m_Weight);
         }
     }
     int transflag = FXFT_Get_Face_Internal_Flag(m_Face);
     FXFT_Set_Transform(m_Face, &ft_matrix, 0);
     int load_flags = (m_Face->face_flags & FT_FACE_FLAG_SFNT) ? FXFT_LOAD_NO_BITMAP : (FXFT_LOAD_NO_BITMAP | FT_LOAD_NO_HINTING);
     int error = FXFT_Load_Glyph(m_Face, glyph_index, load_flags);
     if (error) {
         FXFT_Set_Face_Internal_Flag(m_Face, transflag);
         return NULL;
     }
     int weight = 0;
     if (bUseCJKSubFont) {
         weight = pSubstFont->m_WeightCJK;
     } else {
         weight = pSubstFont ? pSubstFont->m_Weight : 0;
     }
     if (pSubstFont && !(pSubstFont->m_SubstFlags & FXFONT_SUBST_MM) && weight > 400) {
         int index = (weight - 400) / 10;
-        if (index >= 100) {
+        if (index >= WEIGHTPOW_ARRAY_SIZE) {
             FXFT_Set_Face_Internal_Flag(m_Face, transflag);
             return NULL;
         }
         int level = 0;
         if (pSubstFont->m_Charset == FXFONT_SHIFTJIS_CHARSET) {
             level = g_WeightPow_SHIFTJIS[index] * 2 * (FXSYS_abs((int)(ft_matrix.xx)) + FXSYS_abs((int)(ft_matrix.xy))) / 36655;
         } else {
             level = g_WeightPow_11[index] * (FXSYS_abs((int)(ft_matrix.xx)) + FXSYS_abs((int)(ft_matrix.xy))) / 36655;
         }
         FXFT_Outline_Embolden(FXFT_Get_Glyph_Outline(m_Face), level);
@@ skipping 264 matching lines @@
 CFX_PathData* CFX_Font::LoadGlyphPath(FX_DWORD glyph_index, int dest_width)
 {
     if (m_Face == NULL) {
         return NULL;
     }
     FXFT_Set_Pixel_Sizes(m_Face, 0, 64);
     FXFT_Matrix  ft_matrix = {65536, 0, 0, 65536};
     if (m_pSubstFont) {
         if (m_pSubstFont->m_ItalicAngle) {
             int skew = m_pSubstFont->m_ItalicAngle;
-            skew = skew <= -30 ? -58 : -g_AngleSkew[-skew];
+            skew = skew <= -ANGLESKEW_ARRAY_SIZE ? -58 : -g_AngleSkew[-skew];
             if (m_bVertical) {
                 ft_matrix.yx += ft_matrix.yy * skew / 100;
             } else {
                 ft_matrix.xy += -ft_matrix.xx * skew / 100;
             }
         }
         if (m_pSubstFont->m_SubstFlags & FXFONT_SUBST_MM) {
             AdjustMMParams(glyph_index, dest_width, m_pSubstFont->m_Weight);
         }
     }
     int transflag = FXFT_Get_Face_Internal_Flag(m_Face);
     FXFT_Set_Transform(m_Face, &ft_matrix, 0);
     int load_flags = (m_Face->face_flags & FT_FACE_FLAG_SFNT) ? FXFT_LOAD_NO_BITMAP : FXFT_LOAD_NO_BITMAP | FT_LOAD_NO_HINTING;
     int error = FXFT_Load_Glyph(m_Face, glyph_index, load_flags);
     if (error) {
         FXFT_Set_Face_Internal_Flag(m_Face, transflag);
         return NULL;
     }
     if (m_pSubstFont && !(m_pSubstFont->m_SubstFlags & FXFONT_SUBST_MM) && m_pSubstFont->m_Weight > 400) {
+        int index = (m_pSubstFont->m_Weight - 400) / 10;
+        if (index >= WEIGHTPOW_ARRAY_SIZE)
+            index = WEIGHTPOW_ARRAY_SIZE - 1;
         int level = 0;
         if (m_pSubstFont->m_Charset == FXFONT_SHIFTJIS_CHARSET) {
-            level = g_WeightPow_SHIFTJIS[(m_pSubstFont->m_Weight - 400) / 10] * 2 * 65536 / 36655;
+            level = g_WeightPow_SHIFTJIS[index] * 2 * 65536 / 36655;
         } else {
-            level = g_WeightPow[(m_pSubstFont->m_Weight - 400) / 10] * 2;
+            level = g_WeightPow[index] * 2;
         }
         FXFT_Outline_Embolden(FXFT_Get_Glyph_Outline(m_Face), level);
     }
     FXFT_Outline_Funcs funcs;
     funcs.move_to = _Outline_MoveTo;
     funcs.line_to = _Outline_LineTo;
     funcs.conic_to = _Outline_ConicTo;
     funcs.cubic_to = _Outline_CubicTo;
     funcs.shift = 0;
     funcs.delta = 0;
@@ skipping 28 matching lines @@
 {
     va_list argList;
     va_start(argList, count);
     for (int i = 0; i < count; i ++) {
         int p = va_arg(argList, int);
         ((FX_DWORD*)m_Key)[i] = p;
     }
     va_end(argList);
     m_KeyLen = count * sizeof(FX_DWORD);
 }