Add span.h from chromium base.chromium/3392

Allows indexing with better bounds-checking to occur. Some small
modifications are required to deal with PDFium being intentionally
held at C++11 compliance, not C++14.

Use in one place as check on correctness.

Change-Id: Id2875cf0a93980112bc536a93c4f9ec5306c0dac
Reviewed-on: https://pdfium-review.googlesource.com/29671
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Chris Palmer <palmer@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

5 files changed, 29 insertions, 27 deletions

diff --git a/core/fpdfapi/page/cpdf_streamcontentparser.cpp b/core/fpdfapi/page/cpdf_streamcontentparser.cpp
index 697349e987..c251c5ec66 100644
--- a/core/fpdfapi/page/cpdf_streamcontentparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamcontentparser.cpp
@@ -37,6 +37,7 @@
 #include "core/fxge/cfx_graphstatedata.h"
 #include "third_party/base/logging.h"
 #include "third_party/base/ptr_util.h"
+#include "third_party/base/span.h"
 #include "third_party/base/stl_util.h"
 
 namespace {
@@ -1515,7 +1516,8 @@ uint32_t CPDF_StreamContentParser::Parse(const uint8_t* pData,
                                                           pData);
 
   uint32_t InitObjCount = m_pObjectHolder->GetPageObjectList()->size();
-  CPDF_StreamParser syntax(pData, dwSize, m_pDocument->GetByteStringPool());
+  CPDF_StreamParser syntax(pdfium::make_span(pData, dwSize),
+                           m_pDocument->GetByteStringPool());
   CPDF_StreamParserAutoClearer auto_clearer(&m_pSyntax, &syntax);
   while (1) {
     uint32_t cost = m_pObjectHolder->GetPageObjectList()->size() - InitObjCount;
diff --git a/core/fpdfapi/page/cpdf_streamparser.cpp b/core/fpdfapi/page/cpdf_streamparser.cpp
index 3b6d12038f..c6660b799b 100644
--- a/core/fpdfapi/page/cpdf_streamparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamparser.cpp
@@ -101,13 +101,12 @@ uint32_t DecodeInlineStream(const uint8_t* src_buf,
 
 }  // namespace
 
-CPDF_StreamParser::CPDF_StreamParser(const uint8_t* pData, uint32_t dwSize)
-    : m_Size(dwSize), m_Pos(0), m_WordSize(0), m_pBuf(pData) {}
+CPDF_StreamParser::CPDF_StreamParser(pdfium::span<const uint8_t> span)
+    : m_pBuf(span) {}
 
-CPDF_StreamParser::CPDF_StreamParser(const uint8_t* pData,
-                                     uint32_t dwSize,
+CPDF_StreamParser::CPDF_StreamParser(pdfium::span<const uint8_t> span,
                                      const WeakPtr<ByteStringPool>& pPool)
-    : m_Size(dwSize), m_Pos(0), m_WordSize(0), m_pBuf(pData), m_pPool(pPool) {}
+    : m_pPool(pPool), m_pBuf(span) {}
 
 CPDF_StreamParser::~CPDF_StreamParser() {}
 
@@ -115,7 +114,7 @@ std::unique_ptr<CPDF_Stream> CPDF_StreamParser::ReadInlineStream(
     CPDF_Document* pDoc,
     std::unique_ptr<CPDF_Dictionary> pDict,
     CPDF_Object* pCSObj) {
-  if (m_Pos == m_Size)
+  if (m_Pos == m_pBuf.size())
     return nullptr;
 
   if (PDFCharIsWhitespace(m_pBuf[m_Pos]))
@@ -176,17 +175,17 @@ std::unique_ptr<CPDF_Stream> CPDF_StreamParser::ReadInlineStream(
   std::unique_ptr<uint8_t, FxFreeDeleter> pData;
   uint32_t dwStreamSize;
   if (Decoder.IsEmpty()) {
-    if (OrigSize > m_Size - m_Pos)
-      OrigSize = m_Size - m_Pos;
+    if (OrigSize > m_pBuf.size() - m_Pos)
+      OrigSize = m_pBuf.size() - m_Pos;
     pData.reset(FX_Alloc(uint8_t, OrigSize));
-    memcpy(pData.get(), m_pBuf + m_Pos, OrigSize);
+    memcpy(pData.get(), &m_pBuf[m_Pos], OrigSize);
     dwStreamSize = OrigSize;
     m_Pos += OrigSize;
   } else {
     uint8_t* pIgnore = nullptr;
     uint32_t dwDestSize = OrigSize;
     dwStreamSize =
-        DecodeInlineStream(m_pBuf + m_Pos, m_Size - m_Pos, width, height,
+        DecodeInlineStream(&m_pBuf[m_Pos], m_pBuf.size() - m_Pos, width, height,
                            Decoder, pParam, &pIgnore, &dwDestSize);
     FX_Free(pIgnore);
     if (static_cast<int>(dwStreamSize) < 0)
@@ -212,7 +211,7 @@ std::unique_ptr<CPDF_Stream> CPDF_StreamParser::ReadInlineStream(
     }
     m_Pos = dwSavePos;
     pData.reset(FX_Alloc(uint8_t, dwStreamSize));
-    memcpy(pData.get(), m_pBuf + m_Pos, dwStreamSize);
+    memcpy(pData.get(), &m_pBuf[m_Pos], dwStreamSize);
     m_Pos += dwStreamSize;
   }
   pDict->SetNewFor<CPDF_Number>("Length", static_cast<int>(dwStreamSize));
@@ -603,5 +602,5 @@ ByteString CPDF_StreamParser::ReadHexString() {
 }
 
 bool CPDF_StreamParser::PositionIsInBounds() const {
-  return m_Pos < m_Size;
+  return m_Pos < m_pBuf.size();
 }
diff --git a/core/fpdfapi/page/cpdf_streamparser.h b/core/fpdfapi/page/cpdf_streamparser.h
index bdd07643ce..78727da481 100644
--- a/core/fpdfapi/page/cpdf_streamparser.h
+++ b/core/fpdfapi/page/cpdf_streamparser.h
@@ -16,14 +16,14 @@
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fxcrt/string_pool_template.h"
 #include "core/fxcrt/weak_ptr.h"
+#include "third_party/base/span.h"
 
 class CPDF_StreamParser {
  public:
   enum SyntaxType { EndOfData, Number, Keyword, Name, Others };
 
-  CPDF_StreamParser(const uint8_t* pData, uint32_t dwSize);
-  CPDF_StreamParser(const uint8_t* pData,
-                    uint32_t dwSize,
+  explicit CPDF_StreamParser(pdfium::span<const uint8_t> span);
+  CPDF_StreamParser(pdfium::span<const uint8_t> span,
                     const WeakPtr<ByteStringPool>& pPool);
   ~CPDF_StreamParser();
 
@@ -51,12 +51,11 @@ class CPDF_StreamParser {
   ByteString ReadHexString();
   bool PositionIsInBounds() const;
 
-  uint32_t m_Size;      // Length in bytes of m_pBuf.
-  uint32_t m_Pos;       // Current byte position within m_pBuf.
-  uint32_t m_WordSize;  // Current byte position within m_WordBuffer.
-  const uint8_t* m_pBuf;
-  std::unique_ptr<CPDF_Object> m_pLastObj;
+  uint32_t m_Pos = 0;       // Current byte position within m_pBuf.
+  uint32_t m_WordSize = 0;  // Current byte position within m_WordBuffer.
   WeakPtr<ByteStringPool> m_pPool;
+  std::unique_ptr<CPDF_Object> m_pLastObj;
+  pdfium::span<const uint8_t> m_pBuf;
   uint8_t m_WordBuffer[kMaxWordLength + 1];  // Include space for NUL.
 };
 
diff --git a/core/fpdfapi/page/cpdf_streamparser_unittest.cpp b/core/fpdfapi/page/cpdf_streamparser_unittest.cpp
index 40a41befe1..d83fedcb7d 100644
--- a/core/fpdfapi/page/cpdf_streamparser_unittest.cpp
+++ b/core/fpdfapi/page/cpdf_streamparser_unittest.cpp
@@ -4,12 +4,13 @@
 
 #include "core/fpdfapi/page/cpdf_streamparser.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/base/span.h"
 
 TEST(cpdf_streamparser, ReadHexString) {
   {
     // Position out of bounds.
     uint8_t data[] = "12ab>";
-    CPDF_StreamParser parser(data, 5);
+    CPDF_StreamParser parser(data);
     parser.SetPos(6);
     EXPECT_EQ("", parser.ReadHexString());
   }
@@ -17,7 +18,7 @@ TEST(cpdf_streamparser, ReadHexString) {
   {
     // Regular conversion.
     uint8_t data[] = "1A2b>abcd";
-    CPDF_StreamParser parser(data, 5);
+    CPDF_StreamParser parser(data);
     EXPECT_EQ("\x1a\x2b", parser.ReadHexString());
     EXPECT_EQ(5u, parser.GetPos());
   }
@@ -25,7 +26,7 @@ TEST(cpdf_streamparser, ReadHexString) {
   {
     // Missing ending >
     uint8_t data[] = "1A2b";
-    CPDF_StreamParser parser(data, 5);
+    CPDF_StreamParser parser(data);
     EXPECT_EQ("\x1a\x2b", parser.ReadHexString());
     EXPECT_EQ(5u, parser.GetPos());
   }
@@ -33,14 +34,14 @@ TEST(cpdf_streamparser, ReadHexString) {
   {
     // Uneven number of bytes.
     uint8_t data[] = "1A2>asdf";
-    CPDF_StreamParser parser(data, 5);
+    CPDF_StreamParser parser(data);
     EXPECT_EQ("\x1a\x20", parser.ReadHexString());
     EXPECT_EQ(4u, parser.GetPos());
   }
 
   {
     uint8_t data[] = ">";
-    CPDF_StreamParser parser(data, 5);
+    CPDF_StreamParser parser(data);
     EXPECT_EQ("", parser.ReadHexString());
     EXPECT_EQ(1u, parser.GetPos());
   }
diff --git a/core/fxcrt/unowned_ptr.h b/core/fxcrt/unowned_ptr.h
index f9753cde37..b1c9c66b3e 100644
--- a/core/fxcrt/unowned_ptr.h
+++ b/core/fxcrt/unowned_ptr.h
@@ -32,7 +32,8 @@
 //
 // The array indexing operation [] is not supported on an unowned ptr,
 // because an unowned ptr expresses a one to one relationship with some
-// other heap object.
+// other heap object. Use pdfium::span<> for the cases where indexing
+// into an unowned array is desired, which performs the same checks.
 
 namespace fxcrt {