Fix the JBIG2 decoding regressions from commit bc4b82e and 8a9ce57.

core/src/fxcodec/jbig2/JBig2_HuffmanTable.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JBig2_HuffmanTable.h"
 
 #include <string.h>
 
@@ skipping 85 matching lines @@
   unsigned char cTemp;
   if (pStream->read1Byte(&cTemp) == -1)
     return FALSE;
 
   HTOOB = cTemp & 0x01;
   unsigned char HTPS = ((cTemp >> 1) & 0x07) + 1;
   unsigned char HTRS = ((cTemp >> 4) & 0x07) + 1;
   FX_DWORD HTLOW;
   FX_DWORD HTHIGH;
   if (pStream->readInteger(&HTLOW) == -1 ||
-      pStream->readInteger(&HTHIGH) == -1 || HTLOW > HTHIGH) {
+      pStream->readInteger(&HTHIGH) == -1) {
     return FALSE;
   }
 
+  const int low = static_cast<int>(HTLOW);

[Tom Sepez, 2015/12/18 23:10:50]

do you want int32_t here?

+  const int high = static_cast<int>(HTHIGH);
+  if (low > high)
+    return false;
+
   FX_DWORD nSize = 16;
   PREFLEN = FX_Alloc(int, nSize);
   RANGELEN = FX_Alloc(int, nSize);
   RANGELOW = FX_Alloc(int, nSize);
-  FX_DWORD CURRANGELOW = HTLOW;
+  int cur_low = low;
   NTEMP = 0;
   do {
     HT_CHECK_MEMORY_ADJUST
     if ((pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1) ||
         (pStream->readNBits(HTRS, &RANGELEN[NTEMP]) == -1)) {
       return FALSE;
     }
-    RANGELOW[NTEMP] = CURRANGELOW;
-    CURRANGELOW = CURRANGELOW + (1 << RANGELEN[NTEMP]);
+    RANGELOW[NTEMP] = cur_low;
+    cur_low += (1 << RANGELEN[NTEMP]);
     NTEMP = NTEMP + 1;
-  } while (CURRANGELOW < HTHIGH);
+  } while (cur_low < high);
   HT_CHECK_MEMORY_ADJUST
   if (pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1)
     return FALSE;
 
   RANGELEN[NTEMP] = 32;
-  RANGELOW[NTEMP] = HTLOW - 1;
+  RANGELOW[NTEMP] = low - 1;
   ++NTEMP;
   HT_CHECK_MEMORY_ADJUST
   if (pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1)
     return FALSE;
 
   RANGELEN[NTEMP] = 32;
-  RANGELOW[NTEMP] = HTHIGH;
+  RANGELOW[NTEMP] = high;
   NTEMP = NTEMP + 1;
   if (HTOOB) {
     HT_CHECK_MEMORY_ADJUST
     if (pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1)
       return FALSE;
 
     ++NTEMP;
   }
   CODES = FX_Alloc(int, NTEMP);
   int LENMAX = 0;
@@ skipping 10 matching lines @@
   for (int i = 1; i <= LENMAX; ++i) {
     FIRSTCODE[i] = (FIRSTCODE[i - 1] + LENCOUNT[i - 1]) << 1;
     int CURCODE = FIRSTCODE[i];
     for (FX_DWORD j = 0; j < NTEMP; ++j) {
       if (PREFLEN[j] == i)
         CODES[j] = CURCODE++;
     }
   }
   return TRUE;
 }