Use safe arithmentic in CFX_BinaryBuf::ExpandBuf.

core/include/fxcrt/fx_basic.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_INCLUDE_FXCRT_FX_BASIC_H_
 #define CORE_INCLUDE_FXCRT_FX_BASIC_H_
 
 #include <algorithm>
+#include <memory>
 
 #include "core/include/fxcrt/fx_memory.h"
 #include "core/include/fxcrt/fx_stream.h"
 #include "core/include/fxcrt/fx_string.h"
 #include "core/include/fxcrt/fx_system.h"
 
 // The FX_ArraySize(arr) macro returns the # of elements in an array arr.
 // The expression is a compile-time constant, and therefore can be
 // used in defining new arrays, for example.  If you use FX_ArraySize on
 // a pointer by mistake, you will get a compile-time error.
 //
 // One caveat is that FX_ArraySize() doesn't accept any array of an
 // anonymous type or a type defined inside a function.
 #define FX_ArraySize(array) (sizeof(ArraySizeHelper(array)))
 
 // This template function declaration is used in defining FX_ArraySize.
 // Note that the function doesn't need an implementation, as we only
 // use its type.
 template <typename T, size_t N>
 char(&ArraySizeHelper(T(&array)[N]))[N];
 
+// Used with std::unique_ptr to FX_Free raw memory.
+struct FxFreeDeleter {
+  inline void operator()(void* ptr) const { FX_Free(ptr); }
+};
+
+// Used with std::unique_ptr to Release() objects that can't be deleted.
+template <class T>
+struct ReleaseDeleter {
+  inline void operator()(T* ptr) const { ptr->Release(); }
+};
+
 class CFX_BinaryBuf {
  public:
   CFX_BinaryBuf();
-  CFX_BinaryBuf(FX_STRSIZE size);
+  explicit CFX_BinaryBuf(FX_STRSIZE size);
 
-  ~CFX_BinaryBuf();
+  uint8_t* GetBuffer() const { return m_pBuffer.get(); }
+  FX_STRSIZE GetSize() const { return m_DataSize; }
 
   void Clear();
-
   void EstimateSize(FX_STRSIZE size, FX_STRSIZE alloc_step = 0);
-
   void AppendBlock(const void* pBuf, FX_STRSIZE size);
-
-  void AppendFill(uint8_t byte, FX_STRSIZE count);
-
   void AppendString(const CFX_ByteStringC& str) {
     AppendBlock(str.GetPtr(), str.GetLength());
   }
 
-  inline void AppendByte(uint8_t byte) {
-    if (m_AllocSize <= m_DataSize) {
-      ExpandBuf(1);
-    }
-    m_pBuffer[m_DataSize++] = byte;
+  void AppendByte(uint8_t byte) {
+    ExpandBuf(1);
+    m_pBuffer.get()[m_DataSize++] = byte;
   }
 
   void InsertBlock(FX_STRSIZE pos, const void* pBuf, FX_STRSIZE size);
-
-  void AttachData(void* pBuf, FX_STRSIZE size);
-
-  void CopyData(const void* pBuf, FX_STRSIZE size);
-
-  void TakeOver(CFX_BinaryBuf& other);
-
   void Delete(int start_index, int count);
 
-  uint8_t* GetBuffer() const { return m_pBuffer; }
+  // Takes ownership of |pBuf|.
+  void AttachData(uint8_t* pBuf, FX_STRSIZE size);
 
-  FX_STRSIZE GetSize() const { return m_DataSize; }
+  // Releases ownership of |m_pBuffer| and returns it.
+  uint8_t* DetachBuffer();
 
+ protected:
+  void ExpandBuf(FX_STRSIZE size);
+
+  FX_STRSIZE m_AllocStep;
+  FX_STRSIZE m_AllocSize;
+  FX_STRSIZE m_DataSize;
+  std::unique_ptr<uint8_t, FxFreeDeleter> m_pBuffer;
+};
+
+class CFX_ByteTextBuf : public CFX_BinaryBuf {
+ public:
+  void AppendChar(int ch) { AppendByte((uint8_t)ch); }
+  FX_STRSIZE GetLength() const { return m_DataSize; }
   CFX_ByteStringC GetByteString() const;
 
-  void DetachBuffer();
+  CFX_ByteTextBuf& operator<<(int i);
+  CFX_ByteTextBuf& operator<<(FX_DWORD i);
+  CFX_ByteTextBuf& operator<<(double f);
+  CFX_ByteTextBuf& operator<<(const CFX_ByteStringC& lpsz);
+  CFX_ByteTextBuf& operator<<(const CFX_ByteTextBuf& buf);
+};
 
- protected:
-  FX_STRSIZE m_AllocStep;
-
-  uint8_t* m_pBuffer;
-
-  FX_STRSIZE m_DataSize;
-
-  FX_STRSIZE m_AllocSize;
-
-  void ExpandBuf(FX_STRSIZE size);
-};
-class CFX_ByteTextBuf : public CFX_BinaryBuf {
- public:
-  void operator=(const CFX_ByteStringC& str);
-
-  void AppendChar(int ch) { AppendByte((uint8_t)ch); }
-
-  CFX_ByteTextBuf& operator<<(int i);
-
-  CFX_ByteTextBuf& operator<<(FX_DWORD i);
-
-  CFX_ByteTextBuf& operator<<(double f);
-
-  CFX_ByteTextBuf& operator<<(const CFX_ByteStringC& lpsz);
-
-  CFX_ByteTextBuf& operator<<(const CFX_ByteTextBuf& buf);
-
-  FX_STRSIZE GetLength() const { return m_DataSize; }
-};
 class CFX_WideTextBuf : public CFX_BinaryBuf {
  public:
-  void operator=(const FX_WCHAR* lpsz);
-
-  void operator=(const CFX_WideStringC& str);
-
   void AppendChar(FX_WCHAR wch);
-
-  CFX_WideTextBuf& operator<<(int i);
-
-  CFX_WideTextBuf& operator<<(double f);
-
-  CFX_WideTextBuf& operator<<(const FX_WCHAR* lpsz);
-
-  CFX_WideTextBuf& operator<<(const CFX_WideStringC& str);
-  CFX_WideTextBuf& operator<<(const CFX_WideString& str);
-
-  CFX_WideTextBuf& operator<<(const CFX_WideTextBuf& buf);
-
   FX_STRSIZE GetLength() const { return m_DataSize / sizeof(FX_WCHAR); }
-
-  FX_WCHAR* GetBuffer() const { return (FX_WCHAR*)m_pBuffer; }
+  FX_WCHAR* GetBuffer() const {
+    return reinterpret_cast<FX_WCHAR*>(m_pBuffer.get());
+  }
+  CFX_WideStringC GetWideString() const;
 
   void Delete(int start_index, int count) {
     CFX_BinaryBuf::Delete(start_index * sizeof(FX_WCHAR),
                           count * sizeof(FX_WCHAR));
   }
 
-  CFX_WideStringC GetWideString() const;
+  CFX_WideTextBuf& operator<<(int i);
+  CFX_WideTextBuf& operator<<(double f);
+  CFX_WideTextBuf& operator<<(const FX_WCHAR* lpsz);
+  CFX_WideTextBuf& operator<<(const CFX_WideStringC& str);
+  CFX_WideTextBuf& operator<<(const CFX_WideString& str);
+  CFX_WideTextBuf& operator<<(const CFX_WideTextBuf& buf);
 };
+
 #ifdef PDF_ENABLE_XFA
 class CFX_ArchiveSaver {
  public:
   CFX_ArchiveSaver() : m_pStream(NULL) {}
 
   CFX_ArchiveSaver& operator<<(uint8_t i);
 
   CFX_ArchiveSaver& operator<<(int i);
 
   CFX_ArchiveSaver& operator<<(FX_DWORD i);
@@ skipping 879 matching lines @@
  public:
   explicit CFX_AutoRestorer(T* location)
       : m_Location(location), m_OldValue(*location) {}
   ~CFX_AutoRestorer() { *m_Location = m_OldValue; }
 
  private:
   T* const m_Location;
   const T m_OldValue;
 };
 
-struct FxFreeDeleter {
-  inline void operator()(void* ptr) const { FX_Free(ptr); }
-};
-
-// Used with std::unique_ptr to Release() objects that can't be deleted.
-template <class T>
-struct ReleaseDeleter {
-  inline void operator()(T* ptr) const { ptr->Release(); }
-};
-
 #define FX_DATALIST_LENGTH 1024
 template <size_t unit>
 class CFX_SortListArray {
  protected:
   struct DataList {
     int32_t start;
 
     int32_t count;
     uint8_t* data;
   };
@@ skipping 165 matching lines @@
   FX_FLOAT c;
   FX_FLOAT d;
   FX_FLOAT e;
   FX_FLOAT f;
   FX_FLOAT g;
   FX_FLOAT h;
   FX_FLOAT i;
 };
 
 #endif  // CORE_INCLUDE_FXCRT_FX_BASIC_H_