diff options
| -rw-r--r-- | chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.cpp | 7 | ||||
| -rw-r--r-- | chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.h | 2 |
2 files changed, 5 insertions, 4 deletions
diff --git a/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.cpp b/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.cpp index 9fa9776df0d..39afef63353 100644 --- a/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.cpp +++ b/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.cpp @@ -42,7 +42,7 @@ bool CFX_DIBitmap::Create(int width, m_Height = 0; m_Pitch = 0; - uint32_t calculatedSize; + size_t calculatedSize; if (!CFX_DIBitmap::CalculatePitchAndSize(height, width, format, &pitch, &calculatedSize)) return false; @@ -815,7 +815,7 @@ bool CFX_DIBitmap::CalculatePitchAndSize(int height, int width, FXDIB_Format format, uint32_t* pitch, - uint32_t* size) { + size_t* size) { if (width <= 0 || height <= 0) return false; @@ -829,7 +829,8 @@ bool CFX_DIBitmap::CalculatePitchAndSize(int height, if (!*pitch) *pitch = static_cast<uint32_t>((width * bpp + 31) / 32 * 4); - if ((1 << 30) / *pitch < static_cast<uint32_t>(height)) + // The final size of the buffer will be (*size + 4). We are trying to not exceed this. + if ((std::numeric_limits<std::size_t>::max() - 4) / *pitch < static_cast<uint32_t>(height)) return false; *size = *pitch * static_cast<uint32_t>(height); diff --git a/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.h b/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.h index 00a145af68e..acd177002ef 100644 --- a/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.h +++ b/chromium/third_party/pdfium/core/fxge/dib/cfx_dibitmap.h @@ -99,7 +99,7 @@ class CFX_DIBitmap : public CFX_DIBSource { int width, FXDIB_Format format, uint32_t* pitch, - uint32_t* size); + size_t* size); #if defined _SKIA_SUPPORT_ || _SKIA_SUPPORT_PATHS_ void PreMultiply(); |