Memory allocation for WriteInto is not proper.

pdf/pdfium/pdfium_engine.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/pdfium/pdfium_engine.h"
 
 #include <math.h>
 
 #include "base/json/json_writer.h"
 #include "base/logging.h"
@@ skipping 3382 matching lines @@
 
   // A temporary hack. PDFs generated by Cairo (used by Chrome OS to generate
   // a PDF output from a webpage) result in very large metafiles and the
   // rendering using FPDF_RenderPage is incorrect. In this case, render as a
   // bitmap. Note that this code does not kick in for PDFs printed from Chrome
   // because in that case we create a temp PDF first before printing and this
   // temp PDF does not have a creator string that starts with "cairo".
   base::string16 creator;
   size_t buffer_bytes = FPDF_GetMetaText(doc, "Creator", NULL, 0);
   if (buffer_bytes > 1) {
-    FPDF_GetMetaText(doc, "Creator", WriteInto(&creator, buffer_bytes),
-                     buffer_bytes);
+    FPDF_GetMetaText(
+        doc, "Creator", WriteInto(&creator, buffer_bytes + 1), buffer_bytes);
   }
   bool use_bitmap = false;
   if (StartsWith(creator, L"cairo", false))
     use_bitmap = true;
 
   // Another temporary hack. Some PDFs seems to render very slowly if
   // FPDF_RenderPage is directly used on a printer DC. I suspect it is
   // because of the code to talk Postscript directly to the printer if
   // the printer supports this. Need to discuss this with PDFium. For now,
   // render to a bitmap and then blit the bitmap to the DC if we have been
@@ skipping 103 matching lines @@
     double* height) {
   FPDF_DOCUMENT doc = FPDF_LoadMemDocument(pdf_buffer, pdf_buffer_size, NULL);
   if (!doc)
     return false;
   bool success = FPDF_GetPageSizeByIndex(doc, page_number, width, height) != 0;
   FPDF_CloseDocument(doc);
   return success;
 }
 
 }  // namespace chrome_pdf