Relax the check on 0 length streams.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <set>
 #include <utility>
 #include <vector>
 
@@ skipping 2503 matching lines @@
       len = endStreamOffset;
       int numMarkers = ReadEOLMarkers(streamStartPos + endStreamOffset - 2);
       if (numMarkers == 2) {
         len -= 2;
       } else {
         numMarkers = ReadEOLMarkers(streamStartPos + endStreamOffset - 1);
         if (numMarkers == 1) {
           len -= 1;
         }
       }
       if (len <= 0) {

[jun_fang, 2015/10/08 09:19:52]

Relax too?

[Lei Zhang, 2015/10/08 17:33:08]

Done.

         return nullptr;
       }
       pDict->SetAtInteger(FX_BSTRC("Length"), len);
     }
     m_Pos = streamStartPos;
   }
-  if (len <= 0) {
+  if (len < 0) {
     return nullptr;
   }
-  uint8_t* pData = FX_Alloc(uint8_t, len);
-  ReadBlock(pData, len);
+  uint8_t* pData = nullptr;
+  if (len > 0) {
+    pData = FX_Alloc(uint8_t, len);
+    ReadBlock(pData, len);
+  }
   if (pCryptoHandler) {

[jun_fang, 2015/10/08 09:19:52]

If pData is nullptr, there is no data to be decrypted. 
It should be changed to "if (pCryptoHandler && pData) {"

[Lei Zhang, 2015/10/08 17:21:49]

Ok. Since |pData| can only be a nullptr when len == 0, I just moved this block
into the if (len > 0) block.

     CFX_BinaryBuf dest_buf;
     dest_buf.EstimateSize(pCryptoHandler->DecryptGetSize(len));
     void* context = pCryptoHandler->DecryptStart(objnum, gennum);
     pCryptoHandler->DecryptStream(context, pData, len, dest_buf);
     pCryptoHandler->DecryptFinish(context, dest_buf);
     FX_Free(pData);
     pData = dest_buf.GetBuffer();
     len = dest_buf.GetSize();
     dest_buf.DetachBuffer();
   }
@@ skipping 2099 matching lines @@
   return FALSE;
 }
 CPDF_PageNode::~CPDF_PageNode() {
   int32_t iSize = m_childNode.GetSize();
   for (int32_t i = 0; i < iSize; ++i) {
     CPDF_PageNode* pNode = (CPDF_PageNode*)m_childNode[i];
     delete pNode;
   }
   m_childNode.RemoveAll();
 }