Bugs in CJS_PublicMethods::ParseNumber()

fpdfsdk/src/javascript/JS_Value.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JS_Value.h"
 
 #include <time.h>
 #include <cmath>
 #include <limits>
 
 #include "Document.h"
 #include "JS_Define.h"
 #include "JS_Object.h"
 
 static const FX_DWORD g_nan[2] = {0, 0x7FF80000};
 static double GetNan() {
   return *(double*)g_nan;
 }
 
-/* ---------------------------- CJS_Value ---------------------------- */
-
 CJS_Value::CJS_Value(CJS_Runtime* pRuntime)
     : m_eType(VT_unknown), m_pJSRuntime(pRuntime) {
 }
 
 CJS_Value::CJS_Value(CJS_Runtime* pRuntime, v8::Local<v8::Value> pValue, Type t)
     : m_eType(t), m_pValue(pValue), m_pJSRuntime(pRuntime) {
 }
 
 CJS_Value::CJS_Value(CJS_Runtime* pRuntime, const int& iValue)
     : m_pJSRuntime(pRuntime) {
@@ skipping 57 matching lines @@
 void CJS_Value::Attach(CJS_Value* pValue) {
   if (pValue)
     Attach(pValue->ToV8Value(), pValue->GetType());
 }
 
 void CJS_Value::Detach() {
   m_pValue = v8::Local<v8::Value>();
   m_eType = VT_unknown;
 }
 
-/* ----------------------------------------------------------------------------------------
- */
-
 int CJS_Value::ToInt() const {
   return FXJS_ToInt32(m_pJSRuntime->GetIsolate(), m_pValue);
 }
 
 bool CJS_Value::ToBool() const {
   return FXJS_ToBoolean(m_pJSRuntime->GetIsolate(), m_pValue);
 }
 
 double CJS_Value::ToDouble() const {
   return FXJS_ToNumber(m_pJSRuntime->GetIsolate(), m_pValue);
@@ skipping 25 matching lines @@
   return m_pValue;
 }
 
 v8::Local<v8::Array> CJS_Value::ToV8Array() const {
   if (IsArrayObject())
     return v8::Local<v8::Array>::Cast(
         FXJS_ToObject(m_pJSRuntime->GetIsolate(), m_pValue));
   return v8::Local<v8::Array>();
 }
 
-/* ----------------------------------------------------------------------------------------
- */
+void CJS_Value::MaybeCoerceToNumber() {
+  bool bAllowNaN = false;
+  if (m_eType == VT_string) {
+    CFX_ByteString bstr = ToCFXByteString();
+    if (bstr.GetLength() == 0)
+      return;
+    if (bstr == "NaN")
+      bAllowNaN = true;
+  }
+  v8::TryCatch(m_pJSRuntime->GetIsolate());
+  v8::MaybeLocal<v8::Number> maybeNum =
+      m_pValue->ToNumber(m_pJSRuntime->GetIsolate()->GetCurrentContext());
+  if (maybeNum.IsEmpty())
+    return;
+  v8::Local<v8::Number> num = maybeNum.ToLocalChecked();
+  if (std::isnan(num->Value()) && !bAllowNaN)
+    return;
+  m_pValue = num;
+  m_eType = VT_number;
+}
 
 void CJS_Value::operator=(int iValue) {
   m_pValue = FXJS_NewNumber(m_pJSRuntime->GetIsolate(), iValue);
   m_eType = VT_number;
 }
 
 void CJS_Value::operator=(bool bValue) {
   m_pValue = FXJS_NewBoolean(m_pJSRuntime->GetIsolate(), bValue);
   m_eType = VT_boolean;
 }
@@ skipping 49 matching lines @@
   m_pValue = FXJS_NewDate(m_pJSRuntime->GetIsolate(), (double)date);
   m_eType = VT_date;
 }
 
 void CJS_Value::operator=(CJS_Value value) {
   m_pValue = value.ToV8Value();
   m_eType = value.m_eType;
   m_pJSRuntime = value.m_pJSRuntime;
 }
 
-/* ----------------------------------------------------------------------------------------
- */
-
 CJS_Value::Type CJS_Value::GetType() const {
   if (m_pValue.IsEmpty())
     return VT_unknown;
   if (m_pValue->IsString())
     return VT_string;
   if (m_pValue->IsNumber())
     return VT_number;
   if (m_pValue->IsBoolean())
     return VT_boolean;
   if (m_pValue->IsDate())
@@ skipping 629 matching lines @@
   return day * 86400000 + time;
 }
 
 bool JS_PortIsNan(double d) {
   return d != d;
 }
 
 double JS_LocalTime(double d) {
   return JS_GetDateTime() + _getDaylightSavingTA(d);
 }