1 diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp 2 index 46379f6..c6b3f01 100644 3 --- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp 4 +++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp 5 @@ -48,6 +48,7 @@ 6 //---------------------------------------------------------------------------- 7 #include <limits.h> 8 #include "agg_rasterizer_scanline_aa.h" 9 +#include "third_party/base/numerics/safe_math.h" 10 namespace agg 11 { 12 AGG_INLINE void cell_aa::set_cover(int c, int a) 13 @@ -237,7 +238,7 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) 14 int fy1 = y1 & poly_base_mask; 15 int fy2 = y2 & poly_base_mask; 16 int x_from, x_to; 17 - int p, rem, mod, lift, delta, first, incr; 18 + int rem, mod, lift, delta, first, incr; 19 if(ey1 == ey2) { 20 render_hline(ey1, x1, fy1, x2, fy2); 21 return; 22 @@ -268,16 +269,22 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) 23 m_cur_cell.add_cover(delta, two_fx * delta); 24 return; 25 } 26 - p = (poly_base_size - fy1) * dx; 27 + pdfium::base::CheckedNumeric<int> safeP = poly_base_size - fy1; 28 + safeP *= dx; 29 + if (!safeP.IsValid()) 30 + return; 31 first = poly_base_size; 32 if(dy < 0) { 33 - p = fy1 * dx; 34 - first = 0; 35 - incr = -1; 36 - dy = -dy; 37 + safeP = fy1; 38 + safeP *= dx; 39 + if (!safeP.IsValid()) 40 + return; 41 + first = 0; 42 + incr = -1; 43 + dy = -dy; 44 } 45 - delta = p / dy; 46 - mod = p % dy; 47 + delta = safeP.ValueOrDie() / dy; 48 + mod = safeP.ValueOrDie() % dy; 49 if(mod < 0) { 50 delta--; 51 mod += dy; 52 @@ -287,12 +294,15 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) 53 ey1 += incr; 54 set_cur_cell(x_from >> poly_base_shift, ey1); 55 if(ey1 != ey2) { 56 - p = poly_base_size * dx; 57 - lift = p / dy; 58 - rem = p % dy; 59 - if(rem < 0) { 60 - lift--; 61 - rem += dy; 62 + safeP = static_cast<int>(poly_base_size); 63 + safeP *= dx; 64 + if (!safeP.IsValid()) 65 + return; 66 + lift = safeP.ValueOrDie() / dy; 67 + rem = safeP.ValueOrDie() % dy; 68 + if (rem < 0) { 69 + lift--; 70 + rem += dy; 71 } 72 mod -= dy; 73 while(ey1 != ey2) { 74
