Merge to XFA: Fix out of bound access in CPDF_Parser::ParseIndirectObject().

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_parser.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 125 matching lines @@
 
 void CPDF_Parser::SetEncryptDictionary(CPDF_Dictionary* pDict) {
   m_pEncryptDict = pDict;
 }
 
 FX_FILESIZE CPDF_Parser::GetObjectPositionOrZero(FX_DWORD objnum) const {
   auto it = m_ObjectInfo.find(objnum);
   return it != m_ObjectInfo.end() ? it->second.pos : 0;
 }
 
+void CPDF_Parser::ShrinkObjectMap(FX_DWORD objnum) {
+  if (objnum == 0) {
+    m_ObjectInfo.clear();
+    return;
+  }
+
+  auto it = m_ObjectInfo.lower_bound(objnum);
+  while (it != m_ObjectInfo.end()) {
+    auto saved_it = it++;
+    m_ObjectInfo.erase(saved_it);
+  }
+
+  if (!pdfium::ContainsKey(m_ObjectInfo, objnum - 1))
+    m_ObjectInfo[objnum - 1].pos = 0;
+}
+
 void CPDF_Parser::CloseParser(FX_BOOL bReParse) {
   m_bVersionUpdated = FALSE;
   if (!bReParse) {
     delete m_pDocument;
     m_pDocument = NULL;
   }
   if (m_pTrailer) {
     m_pTrailer->Release();
     m_pTrailer = NULL;
   }
@@ skipping 216 matching lines @@
   }
   m_pTrailer = LoadTrailerV4();
   if (!m_pTrailer) {
     return FALSE;
   }
 
   int32_t xrefsize = GetDirectInteger(m_pTrailer, "Size");
   if (xrefsize <= 0 || xrefsize > kMaxXRefSize) {
     return FALSE;
   }
-  m_ObjectInfo[0].pos = 0;
+  ShrinkObjectMap(xrefsize);
   m_V5Type.SetSize(xrefsize);
   CFX_FileSizeArray CrossRefList;
   CFX_FileSizeArray XRefStreamList;
   CrossRefList.Add(xrefpos);
   XRefStreamList.Add(GetDirectInteger(m_pTrailer, "XRefStm"));
 
   std::set<FX_FILESIZE> seen_xrefpos;
   seen_xrefpos.insert(xrefpos);
   // When |m_pTrailer| doesn't have Prev entry or Prev entry value is not
   // numerical, GetDirectInteger() returns 0. Loading will end.
@@ skipping 629 matching lines @@
     return FALSE;
 
   *pos = pStream->GetDict()->GetInteger("Prev");
   int32_t size = pStream->GetDict()->GetInteger("Size");
   if (size < 0) {
     pStream->Release();
     return FALSE;
   }
   if (bMainXRef) {
     m_pTrailer = ToDictionary(pStream->GetDict()->Clone());
-    m_ObjectInfo[0].pos = 0;
+    ShrinkObjectMap(size);
     if (m_V5Type.SetSize(size)) {
       FXSYS_memset(m_V5Type.GetData(), 0, size);
     }
   } else {
     m_Trailers.Add(ToDictionary(pStream->GetDict()->Clone()));
   }
   std::vector<std::pair<int32_t, int32_t> > arrIndex;
   CPDF_Array* pArray = pStream->GetDict()->GetArray("Index");
   if (pArray) {
     FX_DWORD nPairSize = pArray->GetCount() / 2;
@@ skipping 557 matching lines @@
     m_LastXRefOffset = 0;
   }
   if (bLoadV4) {
     m_pTrailer = LoadTrailerV4();
     if (!m_pTrailer) {
       return PDFPARSE_ERROR_SUCCESS;
     }
 
     int32_t xrefsize = GetDirectInteger(m_pTrailer, "Size");
     if (xrefsize > 0) {
-      m_ObjectInfo[0].pos = 0;
+      ShrinkObjectMap(xrefsize);
       m_V5Type.SetSize(xrefsize);
     }
   }
   FX_DWORD dwRet = SetEncryptHandler();
   if (dwRet != PDFPARSE_ERROR_SUCCESS) {
     return dwRet;
   }
   m_pDocument->LoadAsynDoc(m_pLinearized->GetDict());
   if (!m_pDocument->GetRoot() || m_pDocument->GetPageCount() == 0) {
     if (bXRefRebuilt) {
@@ skipping 3369 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray("H");
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }