Properly land "Fix hint table loading issues."

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "parser_int.h"
 
 #include <set>
 #include <utility>
@@ skipping 57 matching lines @@
 }
 
 int32_t GetStreamNCount(CPDF_StreamAcc* pObjStream) {
   return pObjStream->GetDict()->GetInteger(FX_BSTRC("N"));
 }
 
 int32_t GetStreamFirst(CPDF_StreamAcc* pObjStream) {
   return pObjStream->GetDict()->GetInteger(FX_BSTRC("First"));
 }
 
+bool CanReadFromBitStream(const CFX_BitStream* hStream,
+                          const FX_SAFE_DWORD& num_bits) {
+  return (num_bits.IsValid() &&
+          hStream->BitsRemaining() >= num_bits.ValueOrDie());
+}
+
 }  // namespace
 
 // TODO(thestig) Using unique_ptr with ReleaseDeleter is still not ideal.
 // Come up or wait for something better.
 using ScopedFileStream =
     nonstd::unique_ptr<IFX_FileStream, ReleaseDeleter<IFX_FileStream>>;
 
 FX_BOOL IsSignatureDict(const CPDF_Dictionary* pDict) {
   CPDF_Object* pType = pDict->GetElementValue(FX_BSTRC("Type"));
   if (!pType) {
@@ skipping 4600 matching lines @@
   // the fractional position for each shared object reference. For each
   // shared object referenced from a page, there is an indication of
   // where in the page's content stream the object is first referenced.
   FX_DWORD dwSharedNumeratorBits = hStream->GetBits(16);
   // Item 13: Skip Item 13 which has 16 bits.
   hStream->SkipBits(16);
   CPDF_Object* pPageNum = m_pLinearizedDict->GetElementValue(FX_BSTRC("N"));
   int nPages = pPageNum ? pPageNum->GetInteger() : 0;
   if (nPages < 1)
     return FALSE;
+
   FX_SAFE_DWORD required_bits = dwDeltaObjectsBits;
   required_bits *= pdfium::base::checked_cast<FX_DWORD>(nPages);
-  if (!required_bits.IsValid() ||
-      hStream->BitsRemaining() < required_bits.ValueOrDie())
+  if (!CanReadFromBitStream(hStream, required_bits))
     return FALSE;
   for (int i = 0; i < nPages; ++i) {
     FX_SAFE_DWORD safeDeltaObj = hStream->GetBits(dwDeltaObjectsBits);
     safeDeltaObj += dwObjLeastNum;
     if (!safeDeltaObj.IsValid())
       return FALSE;
     m_dwDeltaNObjsArray.Add(safeDeltaObj.ValueOrDie());
   }
   hStream->ByteAlign();
+
   required_bits = dwDeltaPageLenBits;
   required_bits *= pdfium::base::checked_cast<FX_DWORD>(nPages);
-  if (!required_bits.IsValid() ||
-      hStream->BitsRemaining() < required_bits.ValueOrDie())
+  if (!CanReadFromBitStream(hStream, required_bits))
     return FALSE;
   CFX_DWordArray dwPageLenArray;
   for (int i = 0; i < nPages; ++i) {
     FX_SAFE_DWORD safePageLen = hStream->GetBits(dwDeltaPageLenBits);
     safePageLen += dwPageLeastLen;
     if (!safePageLen.IsValid())
       return FALSE;
     dwPageLenArray.Add(safePageLen.ValueOrDie());
   }
   CPDF_Object* pOffsetE = m_pLinearizedDict->GetElementValue(FX_BSTRC("E"));
@@ skipping 20 matching lines @@
         m_szPageOffsetArray.Add(m_szPageOffsetArray[i - 1] +
                                 dwPageLenArray[i - 1]);
       }
     }
   }
   if (nPages > 0) {
     m_szPageOffsetArray.Add(m_szPageOffsetArray[nPages - 1] +
                             dwPageLenArray[nPages - 1]);
   }
   hStream->ByteAlign();
+
   // number of shared objects
   required_bits = dwSharedObjBits;
   required_bits *= pdfium::base::checked_cast<FX_DWORD>(nPages);
-  if (!required_bits.IsValid() ||
-      hStream->BitsRemaining() < required_bits.ValueOrDie())
+  if (!CanReadFromBitStream(hStream, required_bits))
     return FALSE;
   for (int i = 0; i < nPages; i++) {
     m_dwNSharedObjsArray.Add(hStream->GetBits(dwSharedObjBits));
   }
   hStream->ByteAlign();
+
   // array of identifier, sizes = nshared_objects
   for (int i = 0; i < nPages; i++) {
     required_bits = dwSharedIdBits;
     required_bits *= m_dwNSharedObjsArray[i];
-    if (!required_bits.IsValid() ||
-        hStream->BitsRemaining() < required_bits.ValueOrDie())
+    if (!CanReadFromBitStream(hStream, required_bits))
       return FALSE;
     for (int j = 0; j < m_dwNSharedObjsArray[i]; j++) {
       m_dwIdentifierArray.Add(hStream->GetBits(dwSharedIdBits));
     }
   }
   hStream->ByteAlign();
+
   for (int i = 0; i < nPages; i++) {
     FX_SAFE_DWORD safeSize = m_dwNSharedObjsArray[i];
     safeSize *= dwSharedNumeratorBits;
-    if (!safeSize.IsValid() || hStream->BitsRemaining() < safeSize.ValueOrDie())
+    if (!CanReadFromBitStream(hStream, safeSize))
       return FALSE;
     hStream->SkipBits(safeSize.ValueOrDie());
   }
   hStream->ByteAlign();
+
   FX_SAFE_DWORD safeTotalPageLen = pdfium::base::checked_cast<FX_DWORD>(nPages);
   safeTotalPageLen *= dwDeltaPageLenBits;
-  if (!safeTotalPageLen.IsValid() ||
-      hStream->BitsRemaining() < safeTotalPageLen.ValueOrDie())
+  if (!CanReadFromBitStream(hStream, safeTotalPageLen))
     return FALSE;
   hStream->SkipBits(safeTotalPageLen.ValueOrDie());
   hStream->ByteAlign();
   return TRUE;
 }
 FX_BOOL CPDF_HintTables::ReadSharedObjHintTable(CFX_BitStream* hStream,
                                                 FX_DWORD offset) {
   if (!hStream || hStream->IsEOF())
     return FALSE;
   int nStreamOffset = ReadPrimaryHintStreamOffset();
@@ skipping 32 matching lines @@
   FX_DWORD dwDeltaGroupLen = hStream->GetBits(16);
   CPDF_Object* pFirstPageObj =
       m_pLinearizedDict->GetElementValue(FX_BSTRC("O"));
   int nFirstPageObjNum = pFirstPageObj ? pFirstPageObj->GetInteger() : -1;
   if (nFirstPageObjNum < 0)
     return FALSE;
   FX_DWORD dwPrevObjLen = 0;
   FX_DWORD dwCurObjLen = 0;
   FX_SAFE_DWORD required_bits = dwSharedObjTotal;
   required_bits *= dwDeltaGroupLen;
-  if (!required_bits.IsValid() ||
-      hStream->BitsRemaining() < required_bits.ValueOrDie())
+  if (!CanReadFromBitStream(hStream, required_bits))
     return FALSE;
 
   for (int i = 0; i < dwSharedObjTotal; ++i) {
     dwPrevObjLen = dwCurObjLen;
     FX_SAFE_DWORD safeObjLen = hStream->GetBits(dwDeltaGroupLen);
     safeObjLen += dwGroupLeastLen;
     if (!safeObjLen.IsValid())
       return FALSE;
     dwCurObjLen = safeObjLen.ValueOrDie();
     if (i < m_nFirstPageSharedObjs) {
@@ skipping 113 matching lines @@
   if (!pOffset || pOffset->GetType() != PDFOBJ_NUMBER)
     return FALSE;
   int shared_hint_table_offset = pOffset->GetInteger();
   CPDF_StreamAcc acc;
   acc.LoadAllData(pHintStream);
   FX_DWORD size = acc.GetSize();
   // The header section of page offset hint table is 36 bytes.
   // The header section of shared object hint table is 24 bytes.
   // Hint table has at least 60 bytes.
   const FX_DWORD MIN_STREAM_LEN = 60;
-  if (size < MIN_STREAM_LEN || shared_hint_table_offset < 0 ||
-      size < shared_hint_table_offset || !shared_hint_table_offset) {
+  if (size < MIN_STREAM_LEN || shared_hint_table_offset <= 0 ||
+      size < shared_hint_table_offset) {
     return FALSE;
   }
   CFX_BitStream bs;
   bs.Init(acc.GetData(), size);
   return ReadPageHintTable(&bs) &&
          ReadSharedObjHintTable(&bs, pdfium::base::checked_cast<FX_DWORD>(
                                          shared_hint_table_offset));
 }
 int CPDF_HintTables::ReadPrimaryHintStreamOffset() const {
   if (!m_pLinearizedDict)
@@ skipping 10 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray(FX_BSTRC("H"));
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }