From c0f60dc29db66262bbc0082fcd51170a570b0d1f Mon Sep 17 00:00:00 2001
From: dsinclair <dsinclair@chromium.org>
Date: Wed, 21 Sep 2016 12:49:36 -0700
Subject: Check for overflow in CMap_GetCode.

Given a large enough value for the character code it's possible to overflow
the conversion to an int. This Cl updates the code to guard against overflow.

BUG=chromium:648739

Review-Url: https://codereview.chromium.org/2358023002
---
 core/fpdfapi/fpdf_font/fpdf_font_cid.cpp          | 16 +++++++++++-----
 core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp |  5 +++++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp b/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp
index 3f95ec4a96..96c1ef5753 100644
--- a/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp
+++ b/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp
@@ -441,16 +441,22 @@ void CPDF_CMapParser::ParseWord(const CFX_ByteStringC& word) {
 
 // Static.
 uint32_t CPDF_CMapParser::CMap_GetCode(const CFX_ByteStringC& word) {
-  int num = 0;
+  pdfium::base::CheckedNumeric<uint32_t> num = 0;
   if (word.GetAt(0) == '<') {
-    for (int i = 1; i < word.GetLength() && std::isxdigit(word.GetAt(i)); ++i)
+    for (int i = 1; i < word.GetLength() && std::isxdigit(word.GetAt(i)); ++i) {
       num = num * 16 + FXSYS_toHexDigit(word.GetAt(i));
-    return num;
+      if (!num.IsValid())
+        return 0;
+    }
+    return num.ValueOrDie();
   }
 
-  for (int i = 0; i < word.GetLength() && std::isdigit(word.GetAt(i)); ++i)
+  for (int i = 0; i < word.GetLength() && std::isdigit(word.GetAt(i)); ++i) {
     num = num * 10 + FXSYS_toDecimalDigit(static_cast<FX_WCHAR>(word.GetAt(i)));
-  return num;
+    if (!num.IsValid())
+      return 0;
+  }
+  return num.ValueOrDie();
 }
 
 // Static.
diff --git a/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp b/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp
index ccf49ee46a..ec05df5226 100644
--- a/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp
+++ b/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp
@@ -28,6 +28,11 @@ TEST(fpdf_font_cid, CMap_GetCode) {
   EXPECT_EQ(12u, CPDF_CMapParser::CMap_GetCode("12"));
   EXPECT_EQ(12u, CPDF_CMapParser::CMap_GetCode("12d"));
   EXPECT_EQ(128u, CPDF_CMapParser::CMap_GetCode("128"));
+
+  EXPECT_EQ(4294967295u, CPDF_CMapParser::CMap_GetCode("<FFFFFFFF"));
+
+  // Overflow a uint32_t.
+  EXPECT_EQ(0u, CPDF_CMapParser::CMap_GetCode("<100000000"));
 }
 
 TEST(fpdf_font_cid, CMap_GetCodeRange) {
-- 
cgit v1.2.3