From c0f60dc29db66262bbc0082fcd51170a570b0d1f Mon Sep 17 00:00:00 2001 From: dsinclair Date: Wed, 21 Sep 2016 12:49:36 -0700 Subject: Check for overflow in CMap_GetCode. Given a large enough value for the character code it's possible to overflow the conversion to an int. This Cl updates the code to guard against overflow. BUG=chromium:648739 Review-Url: https://codereview.chromium.org/2358023002 --- core/fpdfapi/fpdf_font/fpdf_font_cid.cpp | 16 +++++++++++----- core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp | 5 +++++ 2 files changed, 16 insertions(+), 5 deletions(-) (limited to 'core') diff --git a/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp b/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp index 3f95ec4a96..96c1ef5753 100644 --- a/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp +++ b/core/fpdfapi/fpdf_font/fpdf_font_cid.cpp @@ -441,16 +441,22 @@ void CPDF_CMapParser::ParseWord(const CFX_ByteStringC& word) { // Static. uint32_t CPDF_CMapParser::CMap_GetCode(const CFX_ByteStringC& word) { - int num = 0; + pdfium::base::CheckedNumeric num = 0; if (word.GetAt(0) == '<') { - for (int i = 1; i < word.GetLength() && std::isxdigit(word.GetAt(i)); ++i) + for (int i = 1; i < word.GetLength() && std::isxdigit(word.GetAt(i)); ++i) { num = num * 16 + FXSYS_toHexDigit(word.GetAt(i)); - return num; + if (!num.IsValid()) + return 0; + } + return num.ValueOrDie(); } - for (int i = 0; i < word.GetLength() && std::isdigit(word.GetAt(i)); ++i) + for (int i = 0; i < word.GetLength() && std::isdigit(word.GetAt(i)); ++i) { num = num * 10 + FXSYS_toDecimalDigit(static_cast(word.GetAt(i))); - return num; + if (!num.IsValid()) + return 0; + } + return num.ValueOrDie(); } // Static. diff --git a/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp b/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp index ccf49ee46a..ec05df5226 100644 --- a/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp +++ b/core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp @@ -28,6 +28,11 @@ TEST(fpdf_font_cid, CMap_GetCode) { EXPECT_EQ(12u, CPDF_CMapParser::CMap_GetCode("12")); EXPECT_EQ(12u, CPDF_CMapParser::CMap_GetCode("12d")); EXPECT_EQ(128u, CPDF_CMapParser::CMap_GetCode("128")); + + EXPECT_EQ(4294967295u, CPDF_CMapParser::CMap_GetCode("