Use safe arithmentic in CFX_BinaryBuf::ExpandBuf.

fpdfsdk/src/fsdk_baseform.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/include/fsdk_baseform.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 2443 matching lines @@
     CPDF_Dictionary* pMainDict = pFDF->GetRoot()->GetDictBy("FDF");
     if (!pMainDict)
       return FALSE;
 
     // Get fields
     CPDF_Array* pFields = pMainDict->GetArrayBy("Fields");
     if (!pFields)
       return FALSE;
 
     CFX_ByteTextBuf fdfEncodedData;
-
     for (FX_DWORD i = 0; i < pFields->GetCount(); i++) {
       CPDF_Dictionary* pField = pFields->GetDictAt(i);
       if (!pField)
         continue;
       CFX_WideString name;
       name = pField->GetUnicodeTextBy("T");
       CFX_ByteString name_b = CFX_ByteString::FromUnicode(name);
       CFX_ByteString csBValue = pField->GetStringBy("V");
       CFX_WideString csWValue = PDF_DecodeText(csBValue);
       CFX_ByteString csValue_b = CFX_ByteString::FromUnicode(csWValue);
 
-      fdfEncodedData = fdfEncodedData << name_b.GetBuffer(name_b.GetLength());
+      fdfEncodedData << name_b.GetBuffer(name_b.GetLength());
       name_b.ReleaseBuffer();
-      fdfEncodedData = fdfEncodedData << "=";
-      fdfEncodedData = fdfEncodedData
-                       << csValue_b.GetBuffer(csValue_b.GetLength());
+      fdfEncodedData << "=";
+      fdfEncodedData << csValue_b.GetBuffer(csValue_b.GetLength());
       csValue_b.ReleaseBuffer();
       if (i != pFields->GetCount() - 1)
-        fdfEncodedData = fdfEncodedData << "&";
+        fdfEncodedData << "&";
     }
 
     nBufSize = fdfEncodedData.GetLength();
     pBuf = FX_Alloc(uint8_t, nBufSize);
     FXSYS_memcpy(pBuf, fdfEncodedData.GetBuffer(), nBufSize);
   }
   return TRUE;
 }
 
 FX_BOOL CPDFSDK_InterForm::ExportFieldsToFDFTextBuf(
@@ skipping 381 matching lines @@
       break;
     }
   }
 }
 
 CPDF_Rect CBA_AnnotIterator::GetAnnotRect(const CPDFSDK_Annot* pAnnot) {
   CPDF_Rect rcAnnot;
   pAnnot->GetPDFAnnot()->GetRect(rcAnnot);
   return rcAnnot;
 }