Check fread() return values in CFX_FolderFontInfo::GetFontData().

core/src/fxge/ge/fx_ge_fontmap.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits>
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxge/fx_freetype.h"
@@ skipping 1491 matching lines @@
   } else {
     FX_DWORD nTables = pFont->m_FontTables.GetLength() / 16;
     for (FX_DWORD i = 0; i < nTables; i++) {
       const uint8_t* p = (const uint8_t*)pFont->m_FontTables + i * 16;
       if (GET_TT_LONG(p) == table) {
         offset = GET_TT_LONG(p + 8);
         datasize = GET_TT_LONG(p + 12);
       }
     }
   }
   if (datasize && size >= datasize && pFile) {

[Nico, 2015/11/02 19:55:43]

From how I understood the code, this check was supposed to make sure this would
never happen (no idea if it did so successfully)…

[Lei Zhang, 2015/11/02 19:59:09]

Just because the buffer is big enough, and |pFile| is not NULL, that does not
mean fread() is guaranteed to succeed. e.g. the OS can have a bad day and say
"no data for you!"

-    FXSYS_fseek(pFile, offset, FXSYS_SEEK_SET);
-    FXSYS_fread(buffer, datasize, 1, pFile);
+    if (FXSYS_fseek(pFile, offset, FXSYS_SEEK_SET) < 0 ||
+        FXSYS_fread(buffer, datasize, 1, pFile) != 1) {
+      datasize = 0;
+    }
   }
   if (pFile) {
     FXSYS_fclose(pFile);
   }
   return datasize;
 }
 void CFX_FolderFontInfo::DeleteFont(void* hFont) {}
 FX_BOOL CFX_FolderFontInfo::GetFaceName(void* hFont, CFX_ByteString& name) {
   if (hFont == NULL) {
     return FALSE;
   }
   CFX_FontFaceInfo* pFont = (CFX_FontFaceInfo*)hFont;
   name = pFont->m_FaceName;
   return TRUE;
 }
 FX_BOOL CFX_FolderFontInfo::GetFontCharset(void* hFont, int& charset) {
   return FALSE;
 }
 
 int PDF_GetStandardFontName(CFX_ByteString* name) {
   AltFontName* found = static_cast<AltFontName*>(
       FXSYS_bsearch(name->c_str(), g_AltFontNames, FX_ArraySize(g_AltFontNames),
                     sizeof(AltFontName), compareString));
   if (!found)
     return -1;
 
   *name = g_Base14FontNames[found->m_Index];
   return found->m_Index;
 }