diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp index d2b6a46e4..2f19a1816 100644 --- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp +++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp @@ -227,10 +227,27 @@ AGG_INLINE void outline_aa::render_hline(int ey, int x1, int y1, int x2, int y2) void outline_aa::render_line(int x1, int y1, int x2, int y2) { enum dx_limit_e { dx_limit = 16384 << poly_base_shift }; - int dx = x2 - x1; + pdfium::base::CheckedNumeric safe_dx = x2; + safe_dx -= x1; + if (!safe_dx.IsValid()) + return; + + int dx = safe_dx.ValueOrDie(); if(dx >= dx_limit || dx <= -dx_limit) { - int cx = (x1 + x2) >> 1; - int cy = (y1 + y2) >> 1; + pdfium::base::CheckedNumeric safe_cx = x1; + safe_cx += x2; + safe_cx /= 2; + if (!safe_cx.IsValid()) + return; + + pdfium::base::CheckedNumeric safe_cy = y1; + safe_cy += y2; + safe_cy /= 2; + if (!safe_cy.IsValid()) + return; + + int cx = safe_cx.ValueOrDie(); + int cy = safe_cy.ValueOrDie(); render_line(x1, y1, cx, cy); render_line(cx, cy, x2, y2); }