Add basic checking for RebuildCrossRef

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "parser_int.h"
 
 #include <set>
 #include <utility>
@@ skipping 229 matching lines @@
     dwRet = SetEncryptHandler();
     if (dwRet != PDFPARSE_ERROR_SUCCESS)
       return dwRet;
 
     m_pDocument->LoadDoc();
     if (!m_pDocument->GetRoot())
       return PDFPARSE_ERROR_FORMAT;
   }
   FXSYS_qsort(m_SortedOffset.GetData(), m_SortedOffset.GetSize(),
               sizeof(FX_FILESIZE), CompareFileSize);
-  FX_DWORD RootObjNum = GetRootObjNum();
-  if (RootObjNum == 0) {
+  if (GetRootObjNum() == 0) {
     ReleaseEncryptHandler();
-    RebuildCrossRef();
-    RootObjNum = GetRootObjNum();
-    if (RootObjNum == 0)
+    if (!RebuildCrossRef() || GetRootObjNum() == 0)
       return PDFPARSE_ERROR_FORMAT;
 
     dwRet = SetEncryptHandler();
     if (dwRet != PDFPARSE_ERROR_SUCCESS)
       return dwRet;
   }
   if (m_pSecurityHandler && !m_pSecurityHandler->IsMetadataEncrypted()) {
     CPDF_Reference* pMetadata =
         ToReference(m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata")));
     if (pMetadata)
@@ skipping 702 matching lines @@
     last_trailer = m_Syntax.m_FileLen;
   }
   FX_FILESIZE offset = last_trailer - m_Syntax.m_HeaderOffset;
   void* pResult =
       FXSYS_bsearch(&offset, m_SortedOffset.GetData(), m_SortedOffset.GetSize(),
                     sizeof(FX_FILESIZE), CompareFileSize);
   if (pResult == NULL) {
     m_SortedOffset.Add(offset);
   }
   FX_Free(buffer);
-  return TRUE;
+  return m_pTrailer && m_CrossRef.GetSize() > 0;
 }
 
 FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos,
                                     FX_FILESIZE& prev,
                                     FX_BOOL bMainXRef) {
   CPDF_Object* pObject = ParseIndirectObjectAt(m_pDocument, pos, 0, nullptr);
   if (!pObject)
     return FALSE;
 
   if (m_pDocument) {
@@ skipping 612 matching lines @@
     if (dwRet != PDFPARSE_ERROR_SUCCESS) {
       return dwRet;
     }
     m_pDocument->LoadAsynDoc(m_pLinearized->GetDict());
     if (m_pDocument->GetRoot() == NULL) {
       return PDFPARSE_ERROR_FORMAT;
     }
   }
   FXSYS_qsort(m_SortedOffset.GetData(), m_SortedOffset.GetSize(),
               sizeof(FX_FILESIZE), CompareFileSize);
-  FX_DWORD RootObjNum = GetRootObjNum();
-  if (RootObjNum == 0) {
+  if (GetRootObjNum() == 0) {
     ReleaseEncryptHandler();
-    RebuildCrossRef();
-    RootObjNum = GetRootObjNum();
-    if (RootObjNum == 0) {
+    if (!RebuildCrossRef() || GetRootObjNum() == 0)
       return PDFPARSE_ERROR_FORMAT;
-    }
+
     dwRet = SetEncryptHandler();
     if (dwRet != PDFPARSE_ERROR_SUCCESS) {
       return dwRet;
     }
   }
   if (m_pSecurityHandler && m_pSecurityHandler->IsMetadataEncrypted()) {
     if (CPDF_Reference* pMetadata = ToReference(
             m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata"))))
       m_Syntax.m_MetadataObjnum = pMetadata->GetRefObjNum();
   }
@@ skipping 3318 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray(FX_BSTRC("H"));
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }