Fix AddressSanitizer: heap-buffer-overflow in ValidateCanonicalTime()

Fix AddressSanitizer: heap-buffer-overflow in ValidateCanonicalTime()

BUG=pdfium:378
R=tsepez@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/a74710b8d189ba2c37feab64f0eebc2f96e77382

[jun_fang, 2016-02-01 13:09:16]

jun_fang@foxitsoftware.com changed reviewers:
+ thestig@chromium.org, tsepez@chromium.org

[jun_fang, 2016-02-01 13:09:17]

Hi Tom and Lei,

Please start to review this CL. We may need another patch to refactor the
function CXFA_LocaleValue::ValidateCanonicalTime(). This CL only focuses on
fixing that issue reported in pdfium:378.

https://codereview.chromium.org/1652933002/diff/1/xfa/src/fxfa/src/parser/xfa...
File xfa/src/fxfa/src/parser/xfa_localevalue.cpp (right):

https://codereview.chromium.org/1652933002/diff/1/xfa/src/fxfa/src/parser/xfa...
xfa/src/fxfa/src/parser/xfa_localevalue.cpp:701: while (nIndex - nStart <
wCountM && nIndex < nLen && pTime[nIndex]) {
nIndex should be used after being tested.

https://codereview.chromium.org/1652933002/diff/1/xfa/src/fxfa/src/parser/xfa...
xfa/src/fxfa/src/parser/xfa_localevalue.cpp:713: while (nIndex - nStart <
wCountS && nIndex < nLen && pTime[nIndex]) {
The same as above.

https://codereview.chromium.org/1652933002/diff/1/xfa/src/fxfa/src/parser/xfa...
xfa/src/fxfa/src/parser/xfa_localevalue.cpp:724: while (nIndex - nStart <
wCountF && nIndex < nLen && pTime[nIndex]) {
The same as above.

https://codereview.chromium.org/1652933002/diff/1/xfa/src/fxfa/src/parser/xfa...
xfa/src/fxfa/src/parser/xfa_localevalue.cpp:739: while (nIndex - nStart <
wCountH && nIndex < nLen && pTime[nIndex]) {
The same as above.

https://codereview.chromium.org/1652933002/diff/1/xfa/src/fxfa/src/parser/xfa...
xfa/src/fxfa/src/parser/xfa_localevalue.cpp:751: while (nIndex - nStart <
wCountM && nIndex < nLen && pTime[nIndex]) {
The same as above.

[Tom Sepez, 2016-02-01 20:02:03]

lgtm

[jun_fang, 2016-02-02 03:22:20]

Description was changed from

==========
Fix AddressSanitizer: heap-buffer-overflow in ValidateCanonicalTime()

BUG=pdfium:378
==========

to

==========
Fix AddressSanitizer: heap-buffer-overflow in ValidateCanonicalTime()

BUG=pdfium:378
R=tsepez@chromium.org

Committed:
https://pdfium.googlesource.com/pdfium/+/a74710b8d189ba2c37feab64f0eebc2f96e7...
==========

[jun_fang, 2016-02-02 03:22:24]

Committed patchset #1 (id:1) manually as
a74710b8d189ba2c37feab64f0eebc2f96e77382 (presubmit successful).