Avoid OOB memcpy in chrome_pdf::CopyImage.

pdf/control.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/control.h"
 
 #include "base/logging.h"
 #include "pdf/draw_utils.h"
 
 namespace chrome_pdf {
@@ skipping 35 matching lines @@
   // Some rects in the input list may overlap. To prevent double
   // painting (causes problems with semi-transparent controls) we'll
   // paint control into buffer image data only once and copy requested
   // rectangles.
   pp::ImageData buffer(owner()->GetInstance(), image_data->format(),
                        rect().size(), false);
   if (buffer.is_null())
     return;
 
   pp::Rect draw_rc = pp::Rect(image_data->size()).Intersect(rect());
-  pp::Rect ctrl_rc = pp::Rect(rect().point() - draw_rc.point(), draw_rc.size());
+  pp::Rect ctrl_rc = pp::Rect(draw_rc.point() - rect().point(), draw_rc.size());
   CopyImage(*image_data, draw_rc, &buffer, ctrl_rc, false);
 
   // Temporary move control to origin (0,0) and draw it into temp buffer.
   // Move to the original position afterward. Since this is going on temp
   // buffer, we don't need to invalidate here.
   pp::Rect temp = rect();
   MoveTo(pp::Point(0, 0), false);
   Paint(&buffer, ctrl_rc);
   MoveTo(temp.point(), false);
 
@@ skipping 41 matching lines @@
     owner()->Invalidate(id(), old_rc);
     owner()->Invalidate(id(), rect());
   }
 }
 
 void Control::MoveTo(const pp::Point& origin, bool invalidate) {
   MoveBy(origin - rc_.point(), invalidate);
 }
 
 }  // namespace chrome_pdf