Memory allocation for WriteInto is not proper.

pdf/pdfium/pdfium_page.cc

Index: pdf/pdfium/pdfium_page.cc
diff --git a/pdf/pdfium/pdfium_page.cc b/pdf/pdfium/pdfium_page.cc
index 1f6390c4f1b79bb29b453d1bdb9030880c03af87..d8a5dce5a2a2be4bb08e0a58117a8988c7ea91f1 100644
--- a/pdf/pdfium/pdfium_page.cc
+++ b/pdf/pdfium/pdfium_page.cc
@@ -305,7 +305,7 @@ PDFiumPage::Area PDFiumPage::GetLinkTarget(
             size_t buffer_size =
                 FPDFAction_GetURIPath(engine_->doc(), action, NULL, 0);
             if (buffer_size > 1) {
-              void* data = WriteInto(&target->url, buffer_size);
+              void* data = WriteInto(&target->url, buffer_size + 1);
               FPDFAction_GetURIPath(engine_->doc(), action, data, buffer_size);
             }
           }
@@ -389,7 +389,7 @@ void PDFiumPage::CalculateLinks() {
     int url_length = FPDFLink_GetURL(links, i, NULL, 0);
     if (url_length > 1) {  // WriteInto needs at least 2 characters.
       unsigned short* data =
-          reinterpret_cast<unsigned short*>(WriteInto(&url, url_length));
+          reinterpret_cast<unsigned short*>(WriteInto(&url, url_length + 1));
       FPDFLink_GetURL(links, i, data, url_length);
     }
     Link link;