Fix hint table loading issues.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "parser_int.h"
 
 #include <set>
 #include <utility>
@@ skipping 4626 matching lines @@
   m_szSharedObjOffsetArray.RemoveAll();
 }
 FX_DWORD CPDF_HintTables::GetItemLength(int index,
                                         const CFX_FileSizeArray& szArray) {
   if (index < 0 || szArray.GetSize() < 2 || index > szArray.GetSize() - 2 ||
       szArray[index] > szArray[index + 1])
     return 0;
   return szArray[index + 1] - szArray[index];
 }
 FX_BOOL CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
-  if (!hStream)
+  if (!hStream || hStream->IsEOF())
     return FALSE;
   int nStreamOffset = ReadPrimaryHintStreamOffset();
   int nStreamLen = ReadPrimaryHintStreamLength();
   if (nStreamOffset < 0 || nStreamLen < 1)
     return FALSE;
+
+  const FX_DWORD kHeaderSize = 288;
+  if (hStream->BitsRemaining() < kHeaderSize)
+    return FALSE;
   // Item 1: The least number of objects in a page.
   FX_DWORD dwObjLeastNum = hStream->GetBits(32);
   // Item 2: The location of the first page's page object.
   FX_DWORD dwFirstObjLoc = hStream->GetBits(32);
   if (dwFirstObjLoc > nStreamOffset) {
     FX_SAFE_DWORD safeLoc = pdfium::base::checked_cast<FX_DWORD>(nStreamLen);
     safeLoc += dwFirstObjLoc;
     if (!safeLoc.IsValid())
       return FALSE;
     m_szFirstPageObjOffset =
@@ skipping 22 matching lines @@
   // the fractional position for each shared object reference. For each
   // shared object referenced from a page, there is an indication of
   // where in the page's content stream the object is first referenced.
   FX_DWORD dwSharedNumeratorBits = hStream->GetBits(16);
   // Item 13: Skip Item 13 which has 16 bits.
   hStream->SkipBits(16);
   CPDF_Object* pPageNum = m_pLinearizedDict->GetElementValue(FX_BSTRC("N"));
   int nPages = pPageNum ? pPageNum->GetInteger() : 0;
   if (nPages < 1)
     return FALSE;
+  FX_SAFE_DWORD required_bits = dwDeltaObjectsBits;
+  required_bits *= pdfium::base::checked_cast<FX_DWORD>(nPages);
+  if (!required_bits.IsValid() ||
+      hStream->BitsRemaining() < required_bits.ValueOrDie())

[Lei Zhang, 2015/12/12 01:38:12]

braces, ditto below. Maybe make a helper function?

I know some consider them optional in this case, but it does get harder to read
when the if statement spans multiple lines.

[Oliver Chang, 2015/12/12 02:37:14]

Made a helper. A lot cleaner now.

+    return FALSE;
   for (int i = 0; i < nPages; ++i) {
     FX_SAFE_DWORD safeDeltaObj = hStream->GetBits(dwDeltaObjectsBits);
     safeDeltaObj += dwObjLeastNum;
     if (!safeDeltaObj.IsValid())
       return FALSE;
     m_dwDeltaNObjsArray.Add(safeDeltaObj.ValueOrDie());
   }
   hStream->ByteAlign();
+  required_bits = dwDeltaPageLenBits;
+  required_bits *= pdfium::base::checked_cast<FX_DWORD>(nPages);
+  if (!required_bits.IsValid() ||
+      hStream->BitsRemaining() < required_bits.ValueOrDie())
+    return FALSE;
   CFX_DWordArray dwPageLenArray;
   for (int i = 0; i < nPages; ++i) {
     FX_SAFE_DWORD safePageLen = hStream->GetBits(dwDeltaPageLenBits);
     safePageLen += dwPageLeastLen;
     if (!safePageLen.IsValid())
       return FALSE;
     dwPageLenArray.Add(safePageLen.ValueOrDie());
   }
   CPDF_Object* pOffsetE = m_pLinearizedDict->GetElementValue(FX_BSTRC("E"));
   int nOffsetE = pOffsetE ? pOffsetE->GetInteger() : -1;
@@ skipping 20 matching lines @@
                                 dwPageLenArray[i - 1]);
       }
     }
   }
   if (nPages > 0) {
     m_szPageOffsetArray.Add(m_szPageOffsetArray[nPages - 1] +
                             dwPageLenArray[nPages - 1]);
   }
   hStream->ByteAlign();
   // number of shared objects
+  required_bits = dwSharedObjBits;
+  required_bits *= pdfium::base::checked_cast<FX_DWORD>(nPages);
+  if (!required_bits.IsValid() ||
+      hStream->BitsRemaining() < required_bits.ValueOrDie())
+    return FALSE;
   for (int i = 0; i < nPages; i++) {
     m_dwNSharedObjsArray.Add(hStream->GetBits(dwSharedObjBits));
   }
   hStream->ByteAlign();
   // array of identifier, sizes = nshared_objects
   for (int i = 0; i < nPages; i++) {
+    required_bits = dwSharedIdBits;
+    required_bits *= m_dwNSharedObjsArray[i];
+    if (!required_bits.IsValid() ||
+        hStream->BitsRemaining() < required_bits.ValueOrDie())
+      return FALSE;
     for (int j = 0; j < m_dwNSharedObjsArray[i]; j++) {
       m_dwIdentifierArray.Add(hStream->GetBits(dwSharedIdBits));
     }
   }
   hStream->ByteAlign();
   for (int i = 0; i < nPages; i++) {
     FX_SAFE_DWORD safeSize = m_dwNSharedObjsArray[i];
     safeSize *= dwSharedNumeratorBits;
-    if (!safeSize.IsValid())
+    if (!safeSize.IsValid() || hStream->BitsRemaining() < safeSize.ValueOrDie())
       return FALSE;
     hStream->SkipBits(safeSize.ValueOrDie());
   }
   hStream->ByteAlign();
   FX_SAFE_DWORD safeTotalPageLen = pdfium::base::checked_cast<FX_DWORD>(nPages);
   safeTotalPageLen *= dwDeltaPageLenBits;
-  if (!safeTotalPageLen.IsValid())
+  if (!safeTotalPageLen.IsValid() ||
+      hStream->BitsRemaining() < safeTotalPageLen.ValueOrDie())
     return FALSE;
   hStream->SkipBits(safeTotalPageLen.ValueOrDie());
   hStream->ByteAlign();
   return TRUE;
 }
-FX_BOOL CPDF_HintTables::ReadSharedObjHintTable(CFX_BitStream* hStream) {
-  if (!hStream)
+FX_BOOL CPDF_HintTables::ReadSharedObjHintTable(CFX_BitStream* hStream,
+                                                FX_DWORD offset) {
+  if (!hStream || hStream->IsEOF())
     return FALSE;
   int nStreamOffset = ReadPrimaryHintStreamOffset();
   int nStreamLen = ReadPrimaryHintStreamLength();
   if (nStreamOffset < 0 || nStreamLen < 1)
     return FALSE;
+
+  FX_SAFE_DWORD bit_offset = offset;
+  bit_offset *= 8;
+  if (!bit_offset.IsValid() || hStream->GetPos() > bit_offset.ValueOrDie())
+    return FALSE;
+  hStream->SkipBits(bit_offset.ValueOrDie() - hStream->GetPos());
+
+  const FX_DWORD kHeaderSize = 192;
+  if (hStream->BitsRemaining() < kHeaderSize)
+    return FALSE;
   // Item 1: The object number of the first object in the shared objects
   // section.
   FX_DWORD dwFirstSharedObjNum = hStream->GetBits(32);
   // Item 2: The location of the first object in the shared objects section.
   FX_DWORD dwFirstSharedObjLoc = hStream->GetBits(32);
   if (dwFirstSharedObjLoc > nStreamOffset)
     dwFirstSharedObjLoc += nStreamLen;
   // Item 3: The number of shared object entries for the first page.
   m_nFirstPageSharedObjs = hStream->GetBits(32);
   // Item 4: The number of shared object entries for the shared objects
   // section, including the number of shared object entries for the first page.
   FX_DWORD dwSharedObjTotal = hStream->GetBits(32);
   // Item 5: The number of bits needed to represent the greatest number of
   // objects in a shared object group. Skipped.
   hStream->SkipBits(16);
   // Item 6: The least length of a shared object group in bytes.
   FX_DWORD dwGroupLeastLen = hStream->GetBits(32);
   // Item 7: The number of bits needed to represent the difference between the
   // greatest and least length of a shared object group, in bytes.
   FX_DWORD dwDeltaGroupLen = hStream->GetBits(16);
   CPDF_Object* pFirstPageObj =
       m_pLinearizedDict->GetElementValue(FX_BSTRC("O"));
   int nFirstPageObjNum = pFirstPageObj ? pFirstPageObj->GetInteger() : -1;
   if (nFirstPageObjNum < 0)
     return FALSE;
   FX_DWORD dwPrevObjLen = 0;
   FX_DWORD dwCurObjLen = 0;
+  FX_SAFE_DWORD required_bits = dwSharedObjTotal;
+  required_bits *= dwDeltaGroupLen;
+  if (!required_bits.IsValid() ||
+      hStream->BitsRemaining() < required_bits.ValueOrDie())
+    return FALSE;
+
   for (int i = 0; i < dwSharedObjTotal; ++i) {
     dwPrevObjLen = dwCurObjLen;
     FX_SAFE_DWORD safeObjLen = hStream->GetBits(dwDeltaGroupLen);
     safeObjLen += dwGroupLeastLen;
     if (!safeObjLen.IsValid())
       return FALSE;
     dwCurObjLen = safeObjLen.ValueOrDie();
     if (i < m_nFirstPageSharedObjs) {
       m_dwSharedObjNumArray.Add(nFirstPageObjNum + i);
       if (i == 0)
@@ skipping 17 matching lines @@
     }
   }
   if (dwSharedObjTotal > 0) {
     FX_SAFE_INT32 safeLoc = pdfium::base::checked_cast<int32_t>(dwCurObjLen);
     safeLoc += m_szSharedObjOffsetArray[dwSharedObjTotal - 1];
     if (!safeLoc.IsValid())
       return FALSE;
     m_szSharedObjOffsetArray.Add(safeLoc.ValueOrDie());
   }
   hStream->ByteAlign();
+  if (hStream->BitsRemaining() < dwSharedObjTotal)
+    return FALSE;
   hStream->SkipBits(dwSharedObjTotal);
   hStream->ByteAlign();
   return TRUE;
 }
 FX_BOOL CPDF_HintTables::GetPagePos(int index,
                                     FX_FILESIZE& szPageStartPos,
                                     FX_FILESIZE& szPageLength,
                                     FX_DWORD& dwObjNum) {
   if (!m_pLinearizedDict)
     return FALSE;
@@ skipping 41 matching lines @@
   }
   CPDF_Object* pFirstPageObj =
       m_pLinearizedDict->GetElementValue(FX_BSTRC("O"));
   int nFirstPageObjNum = pFirstPageObj ? pFirstPageObj->GetInteger() : -1;
   if (nFirstPageObjNum < 0)
     return FALSE;  // TODO(thestig): Fix this and the return type.
   FX_DWORD dwIndex = 0;
   FX_DWORD dwObjNum = 0;
   for (int j = 0; j < m_dwNSharedObjsArray[index]; ++j) {
     dwIndex = m_dwIdentifierArray[offset + j];
+    if (dwIndex >= m_dwSharedObjNumArray.GetSize())
+      return IPDF_DataAvail::DataNotAvailable;
     dwObjNum = m_dwSharedObjNumArray[dwIndex];
     if (dwObjNum >= nFirstPageObjNum &&
         dwObjNum < nFirstPageObjNum + m_nFirstPageSharedObjs) {
       continue;
     }
     dwLength = GetItemLength(dwIndex, m_szSharedObjOffsetArray);
     if (!dwLength ||
         !m_pDataAvail->IsDataAvail(m_szSharedObjOffsetArray[dwIndex], dwLength,
                                    pHints)) {
       return IPDF_DataAvail::DataNotAvailable;
     }
   }
   return IPDF_DataAvail::DataAvailable;
 }
 FX_BOOL CPDF_HintTables::LoadHintStream(CPDF_Stream* pHintStream) {
   if (!pHintStream || !m_pLinearizedDict)
     return FALSE;
   CPDF_Dictionary* pDict = pHintStream->GetDict();
   CPDF_Object* pOffset = pDict ? pDict->GetElement(FX_BSTRC("S")) : nullptr;
   if (!pOffset || pOffset->GetType() != PDFOBJ_NUMBER)
     return FALSE;
+  int shared_hint_table_offset = pOffset->GetInteger();
   CPDF_StreamAcc acc;
   acc.LoadAllData(pHintStream);
   FX_DWORD size = acc.GetSize();
   // The header section of page offset hint table is 36 bytes.
   // The header section of shared object hint table is 24 bytes.
   // Hint table has at least 60 bytes.
   const FX_DWORD MIN_STREAM_LEN = 60;
-  if (size < MIN_STREAM_LEN || size < pOffset->GetInteger() ||
-      !pOffset->GetInteger()) {
+  if (size < MIN_STREAM_LEN || shared_hint_table_offset < 0 ||
+      size < shared_hint_table_offset || !shared_hint_table_offset) {
     return FALSE;
   }
   CFX_BitStream bs;
   bs.Init(acc.GetData(), size);
-  return ReadPageHintTable(&bs) && ReadSharedObjHintTable(&bs);
+  return ReadPageHintTable(&bs) &&
+         ReadSharedObjHintTable(&bs, pdfium::base::checked_cast<FX_DWORD>(
+                                         shared_hint_table_offset));
 }
 int CPDF_HintTables::ReadPrimaryHintStreamOffset() const {
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray(FX_BSTRC("H"));
   if (!pRange)
     return -1;
   CPDF_Object* pStreamOffset = pRange->GetElementValue(0);
   if (!pStreamOffset)
     return -1;
   return pStreamOffset->GetInteger();
 }
 int CPDF_HintTables::ReadPrimaryHintStreamLength() const {
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray(FX_BSTRC("H"));
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }