Memory allocation for WriteInto is not proper.

pdf/pdfium/pdfium_page.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/pdfium/pdfium_page.h"
 
 #include <math.h>
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 287 matching lines @@
             return GetDestinationTarget(dest, target);
           // TODO(gene): We don't fully support all types of the in-document
           // links. Need to implement that. There is a bug to track that:
           // http://code.google.com/p/chromium/issues/detail?id=55776
         } break;
       case PDFACTION_URI: {
           if (target) {
             size_t buffer_size =
                 FPDFAction_GetURIPath(engine_->doc(), action, NULL, 0);
             if (buffer_size > 1) {
-              void* data = WriteInto(&target->url, buffer_size);
+              void* data = WriteInto(&target->url, buffer_size + 1);
               FPDFAction_GetURIPath(engine_->doc(), action, data, buffer_size);
             }
           }
           return WEBLINK_AREA;
         } break;
       // TODO(gene): We don't support PDFACTION_REMOTEGOTO and PDFACTION_LAUNCH
       // at the moment.
     }
   }
 
@@ skipping 63 matching lines @@
     return;
 
   calculated_links_ = true;
   FPDF_PAGELINK links = FPDFLink_LoadWebLinks(GetTextPage());
   int count = FPDFLink_CountWebLinks(links);
   for (int i = 0; i < count; ++i) {
     base::string16 url;
     int url_length = FPDFLink_GetURL(links, i, NULL, 0);
     if (url_length > 1) {  // WriteInto needs at least 2 characters.
       unsigned short* data =
-          reinterpret_cast<unsigned short*>(WriteInto(&url, url_length));
+          reinterpret_cast<unsigned short*>(WriteInto(&url, url_length + 1));
       FPDFLink_GetURL(links, i, data, url_length);
     }
     Link link;
     link.url = base::UTF16ToUTF8(url);
 
     // If the link cannot be converted to a pp::Var, then it is not possible to
     // pass it to JS. In this case, ignore the link like other PDF viewers.
     // See http://crbug.com/312882 for an example.
     pp::Var link_var(link.url);
     if (!link_var.is_string())
@@ skipping 65 matching lines @@
       new_left, new_top, new_right - new_left + 1, new_bottom - new_top + 1);
 }
 
 PDFiumPage::Link::Link() {
 }
 
 PDFiumPage::Link::~Link() {
 }
 
 }  // namespace chrome_pdf