Use safe arithmentic in CFX_BinaryBuf::ExpandBuf.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_parser.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 1855 matching lines @@
     }
   }
   GetNextChar(ch);
   return buf.GetByteString();
 }
 CFX_ByteString CPDF_SyntaxParser::ReadHexString() {
   uint8_t ch;
   if (!GetNextChar(ch))
     return CFX_ByteString();
 
-  CFX_BinaryBuf buf;
+  CFX_ByteTextBuf buf;
   bool bFirst = true;
   uint8_t code = 0;
   while (1) {
     if (ch == '>')
       break;
 
     if (std::isxdigit(ch)) {
       int val = FXSYS_toHexDigit(ch);
       if (bFirst) {
         code = val * 16;
       } else {
         code += val;
-        buf.AppendByte((uint8_t)code);
+        buf.AppendByte(code);
       }
       bFirst = !bFirst;
     }
 
     if (!GetNextChar(ch))
       break;
   }
   if (!bFirst)
-    buf.AppendByte((uint8_t)code);
+    buf.AppendByte(code);
 
   return buf.GetByteString();
 }
 void CPDF_SyntaxParser::ToNextLine() {
   uint8_t ch;
   while (GetNextChar(ch)) {
     if (ch == '\n') {
       break;
     }
     if (ch == '\r') {
@@ skipping 2831 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArrayBy("H");
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }