Use safe arithmentic in CFX_BinaryBuf::ExpandBuf.

fpdfsdk/src/fsdk_baseform.cpp

Index: fpdfsdk/src/fsdk_baseform.cpp
diff --git a/fpdfsdk/src/fsdk_baseform.cpp b/fpdfsdk/src/fsdk_baseform.cpp
index 00ab6c2ef0185c598ea979395395593864bbc348..f05545a6726fd5ce2686749c569c8214582444e7 100644
--- a/fpdfsdk/src/fsdk_baseform.cpp
+++ b/fpdfsdk/src/fsdk_baseform.cpp
@@ -2461,7 +2461,6 @@ FX_BOOL CPDFSDK_InterForm::FDFToURLEncodedData(uint8_t*& pBuf,
       return FALSE;
 
     CFX_ByteTextBuf fdfEncodedData;
-
     for (FX_DWORD i = 0; i < pFields->GetCount(); i++) {
       CPDF_Dictionary* pField = pFields->GetDictAt(i);
       if (!pField)
@@ -2473,14 +2472,13 @@ FX_BOOL CPDFSDK_InterForm::FDFToURLEncodedData(uint8_t*& pBuf,
       CFX_WideString csWValue = PDF_DecodeText(csBValue);
       CFX_ByteString csValue_b = CFX_ByteString::FromUnicode(csWValue);
 
-      fdfEncodedData = fdfEncodedData << name_b.GetBuffer(name_b.GetLength());
+      fdfEncodedData << name_b.GetBuffer(name_b.GetLength());
       name_b.ReleaseBuffer();
-      fdfEncodedData = fdfEncodedData << "=";
-      fdfEncodedData = fdfEncodedData
-                       << csValue_b.GetBuffer(csValue_b.GetLength());
+      fdfEncodedData << "=";
+      fdfEncodedData << csValue_b.GetBuffer(csValue_b.GetLength());
       csValue_b.ReleaseBuffer();
       if (i != pFields->GetCount() - 1)
-        fdfEncodedData = fdfEncodedData << "&";
+        fdfEncodedData << "&";
     }
 
     nBufSize = fdfEncodedData.GetLength();