1diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp 2index 46379f6..c6b3f01 100644 3--- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp 4+++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp 5@@ -48,6 +48,7 @@ 6 //---------------------------------------------------------------------------- 7 #include <limits.h> 8 #include "agg_rasterizer_scanline_aa.h" 9+#include "third_party/base/numerics/safe_math.h" 10 namespace agg 11 { 12 AGG_INLINE void cell_aa::set_cover(int c, int a) 13@@ -237,7 +238,7 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) 14 int fy1 = y1 & poly_base_mask; 15 int fy2 = y2 & poly_base_mask; 16 int x_from, x_to; 17- int p, rem, mod, lift, delta, first, incr; 18+ int rem, mod, lift, delta, first, incr; 19 if(ey1 == ey2) { 20 render_hline(ey1, x1, fy1, x2, fy2); 21 return; 22@@ -268,16 +269,22 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) 23 m_cur_cell.add_cover(delta, two_fx * delta); 24 return; 25 } 26- p = (poly_base_size - fy1) * dx; 27+ pdfium::base::CheckedNumeric<int> safeP = poly_base_size - fy1; 28+ safeP *= dx; 29+ if (!safeP.IsValid()) 30+ return; 31 first = poly_base_size; 32 if(dy < 0) { 33- p = fy1 * dx; 34- first = 0; 35- incr = -1; 36- dy = -dy; 37+ safeP = fy1; 38+ safeP *= dx; 39+ if (!safeP.IsValid()) 40+ return; 41+ first = 0; 42+ incr = -1; 43+ dy = -dy; 44 } 45- delta = p / dy; 46- mod = p % dy; 47+ delta = safeP.ValueOrDie() / dy; 48+ mod = safeP.ValueOrDie() % dy; 49 if(mod < 0) { 50 delta--; 51 mod += dy; 52@@ -287,12 +294,15 @@ void outline_aa::render_line(int x1, int y1, int x2, int y2) 53 ey1 += incr; 54 set_cur_cell(x_from >> poly_base_shift, ey1); 55 if(ey1 != ey2) { 56- p = poly_base_size * dx; 57- lift = p / dy; 58- rem = p % dy; 59- if(rem < 0) { 60- lift--; 61- rem += dy; 62+ safeP = static_cast<int>(poly_base_size); 63+ safeP *= dx; 64+ if (!safeP.IsValid()) 65+ return; 66+ lift = safeP.ValueOrDie() / dy; 67+ rem = safeP.ValueOrDie() % dy; 68+ if (rem < 0) { 69+ lift--; 70+ rem += dy; 71 } 72 mod -= dy; 73 while(ey1 != ey2) { 74