Fix parsing of object numbers > 16,777,216.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_parser.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 516 matching lines @@
     bool bIsNumber;
     CFX_ByteString word = m_Syntax.GetNextWord(&bIsNumber);
     if (word.IsEmpty())
       return false;
 
     if (!bIsNumber) {
       m_Syntax.RestorePos(SavedPos);
       break;
     }
 
-    FX_DWORD start_objnum = FXSYS_atoi(word);
+    FX_DWORD start_objnum = FXSYS_atoui(word);
     if (start_objnum >= kMaxObjectNumber)
       return false;
 
     FX_DWORD count = m_Syntax.GetDirectNum();
     m_Syntax.ToNextWord();
     SavedPos = m_Syntax.SavePos();
     const int32_t recordsize = 20;
 
     m_dwXrefStartObjNum = start_objnum;
     if (!bSkip) {
@@ skipping 203 matching lines @@
             case 2:
               if (byte != 'j') {
                 --i;
                 state = ParserState::kDefault;
               } else {
                 inside_index++;
               }
               break;
             case 3:
               if (PDFCharIsWhitespace(byte) || PDFCharIsDelimiter(byte)) {
-                if (objnum > 0x1000000) {
-                  state = ParserState::kDefault;
-                  break;
-                }
                 FX_FILESIZE obj_pos = start_pos - m_Syntax.m_HeaderOffset;
                 m_SortedOffset.insert(obj_pos);
                 last_obj = start_pos;
                 FX_FILESIZE obj_end = 0;
                 CPDF_Object* pObject = ParseIndirectObjectAtByStrict(
                     m_pDocument, obj_pos, objnum, &obj_end);
                 if (CPDF_Stream* pStream = ToStream(pObject)) {
                   if (CPDF_Dictionary* pDict = pStream->GetDict()) {
                     if ((pDict->KeyExist("Type")) &&
                         (pDict->GetStringBy("Type") == "XRef" &&
@@ skipping 541 matching lines @@
   FX_FILESIZE SavedPos = m_Syntax.SavePos();
   m_Syntax.RestorePos(pos);
 
   bool bIsNumber;
   CFX_ByteString word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber) {
     m_Syntax.RestorePos(SavedPos);
     return;
   }
 
-  FX_DWORD parser_objnum = FXSYS_atoi(word);
+  FX_DWORD parser_objnum = FXSYS_atoui(word);
   if (parser_objnum && parser_objnum != objnum) {
     m_Syntax.RestorePos(SavedPos);
     return;
   }
 
   word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber) {
     m_Syntax.RestorePos(SavedPos);
     return;
   }
@@ skipping 51 matching lines @@
   m_Syntax.RestorePos(pos);
   bool bIsNumber;
   CFX_ByteString word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber) {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
   FX_FILESIZE objOffset = m_Syntax.SavePos();
   objOffset -= word.GetLength();
-  FX_DWORD parser_objnum = FXSYS_atoi(word);
+  FX_DWORD parser_objnum = FXSYS_atoui(word);
   if (objnum && parser_objnum != objnum) {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
   word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber) {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
-  FX_DWORD parser_gennum = FXSYS_atoi(word);
+  FX_DWORD parser_gennum = FXSYS_atoui(word);
   if (m_Syntax.GetKeyword() != "obj") {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
   CPDF_Object* pObj = m_Syntax.GetObject(pObjList, objnum, parser_gennum, true);
   m_Syntax.SavePos();
 
   CFX_ByteString bsWord = m_Syntax.GetKeyword();
   if (bsWord == "endobj")
@@ skipping 16 matching lines @@
   FX_FILESIZE SavedPos = m_Syntax.SavePos();
   m_Syntax.RestorePos(pos);
 
   bool bIsNumber;
   CFX_ByteString word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber) {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
-  FX_DWORD parser_objnum = FXSYS_atoi(word);
+  FX_DWORD parser_objnum = FXSYS_atoui(word);
   if (objnum && parser_objnum != objnum) {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
   word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber) {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
-  FX_DWORD gennum = FXSYS_atoi(word);
+  FX_DWORD gennum = FXSYS_atoui(word);
   if (m_Syntax.GetKeyword() != "obj") {
     m_Syntax.RestorePos(SavedPos);
     return nullptr;
   }
 
   CPDF_Object* pObj = m_Syntax.GetObjectByStrict(pObjList, objnum, gennum);
   if (pResultPos)
     *pResultPos = m_Syntax.m_Pos;
 
   m_Syntax.RestorePos(SavedPos);
@@ skipping 29 matching lines @@
                                       FX_DWORD offset) {
   m_Syntax.InitParser(pFileAccess, offset);
   m_Syntax.RestorePos(m_Syntax.m_HeaderOffset + 9);
 
   FX_FILESIZE SavedPos = m_Syntax.SavePos();
   bool bIsNumber;
   CFX_ByteString word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber)
     return FALSE;
 
-  FX_DWORD objnum = FXSYS_atoi(word);
+  FX_DWORD objnum = FXSYS_atoui(word);
   word = m_Syntax.GetNextWord(&bIsNumber);
   if (!bIsNumber)
     return FALSE;
 
-  FX_DWORD gennum = FXSYS_atoi(word);
+  FX_DWORD gennum = FXSYS_atoui(word);
   if (m_Syntax.GetKeyword() != "obj") {
     m_Syntax.RestorePos(SavedPos);
     return FALSE;
   }
 
   m_pLinearized = m_Syntax.GetObject(nullptr, objnum, gennum, true);
   if (!m_pLinearized)
     return FALSE;
 
   CPDF_Dictionary* pDict = m_pLinearized->GetDict();
@@ skipping 507 matching lines @@
   CFX_ByteString word = GetNextWord(&bIsNumber);
   if (word.GetLength() == 0)
     return nullptr;
 
   if (bIsNumber) {
     FX_FILESIZE SavedPos = m_Pos;
     CFX_ByteString nextword = GetNextWord(&bIsNumber);
     if (bIsNumber) {
       CFX_ByteString nextword2 = GetNextWord(nullptr);
       if (nextword2 == "R") {
-        FX_DWORD objnum = FXSYS_atoi(word);
+        FX_DWORD objnum = FXSYS_atoui(word);
         return new CPDF_Reference(pObjList, objnum);
       }
     }
     m_Pos = SavedPos;
     return new CPDF_Number(word);
   }
 
   if (word == "true" || word == "false")
     return new CPDF_Boolean(word == "true");
 
@@ skipping 103 matching lines @@
   CFX_ByteString word = GetNextWord(&bIsNumber);
   if (word.GetLength() == 0)
     return nullptr;
 
   if (bIsNumber) {
     FX_FILESIZE SavedPos = m_Pos;
     CFX_ByteString nextword = GetNextWord(&bIsNumber);
     if (bIsNumber) {
       CFX_ByteString nextword2 = GetNextWord(nullptr);
       if (nextword2 == "R")
-        return new CPDF_Reference(pObjList, FXSYS_atoi(word));
+        return new CPDF_Reference(pObjList, FXSYS_atoui(word));
     }
     m_Pos = SavedPos;
     return new CPDF_Number(word);
   }
 
   if (word == "true" || word == "false")
     return new CPDF_Boolean(word == "true");
 
   if (word == "null")
     return new CPDF_Null;
@@ skipping 256 matching lines @@
   m_HeaderOffset = HeaderOffset;
   m_FileLen = pFileAccess->GetSize();
   m_Pos = 0;
   m_pFileAccess = pFileAccess;
   m_BufOffset = 0;
   pFileAccess->ReadBlock(
       m_pFileBuf, 0,
       (size_t)((FX_FILESIZE)m_BufSize > m_FileLen ? m_FileLen : m_BufSize));
 }
 
-int32_t CPDF_SyntaxParser::GetDirectNum() {
+uint32_t CPDF_SyntaxParser::GetDirectNum() {
   bool bIsNumber;
   GetNextWordInternal(&bIsNumber);
   if (!bIsNumber)
     return 0;
 
   m_WordBuffer[m_WordSize] = 0;
-  return FXSYS_atoi(reinterpret_cast<const FX_CHAR*>(m_WordBuffer));
+  return FXSYS_atoui(reinterpret_cast<const FX_CHAR*>(m_WordBuffer));
 }
 
 bool CPDF_SyntaxParser::IsWholeWord(FX_FILESIZE startpos,
                                     FX_FILESIZE limit,
                                     const CFX_ByteStringC& tag,
                                     FX_BOOL checkKeyword) {
   const FX_DWORD taglen = tag.GetLength();
 
   bool bCheckLeft = !PDFCharIsDelimiter(tag[0]) && !PDFCharIsWhitespace(tag[0]);
   bool bCheckRight = !PDFCharIsDelimiter(tag[taglen - 1]) &&
@@ skipping 1086 matching lines @@
     FX_DWORD objnum,
     CPDF_IndirectObjectHolder* pObjList) {
   FX_FILESIZE SavedPos = m_syntaxParser.SavePos();
   m_syntaxParser.RestorePos(pos);
 
   bool bIsNumber;
   CFX_ByteString word = m_syntaxParser.GetNextWord(&bIsNumber);
   if (!bIsNumber)
     return nullptr;
 
-  FX_DWORD parser_objnum = FXSYS_atoi(word);
+  FX_DWORD parser_objnum = FXSYS_atoui(word);
   if (objnum && parser_objnum != objnum)
     return nullptr;
 
   word = m_syntaxParser.GetNextWord(&bIsNumber);
   if (!bIsNumber)
     return nullptr;
 
-  FX_DWORD gennum = FXSYS_atoi(word);
+  FX_DWORD gennum = FXSYS_atoui(word);
   if (m_syntaxParser.GetKeyword() != "obj") {
     m_syntaxParser.RestorePos(SavedPos);
     return nullptr;
   }
 
   CPDF_Object* pObj =
       m_syntaxParser.GetObject(pObjList, parser_objnum, gennum, true);
   m_syntaxParser.RestorePos(SavedPos);
   return pObj;
 }
@@ skipping 28 matching lines @@
 
   m_dwHeaderOffset = offset;
   m_syntaxParser.InitParser(file.get(), offset);
   m_syntaxParser.RestorePos(m_syntaxParser.m_HeaderOffset + 9);
 
   bool bNumber;
   CFX_ByteString wordObjNum = m_syntaxParser.GetNextWord(&bNumber);
   if (!bNumber)
     return FALSE;
 
-  FX_DWORD objnum = FXSYS_atoi(wordObjNum);
+  FX_DWORD objnum = FXSYS_atoui(wordObjNum);
   if (m_pLinearized) {
     m_pLinearized->Release();
     m_pLinearized = nullptr;
   }
 
   m_pLinearized =
       ParseIndirectObjectAt(m_syntaxParser.m_HeaderOffset + 9, objnum);
   if (!m_pLinearized)
     return FALSE;
 
@@ skipping 72 matching lines @@
     m_pFileRead->ReadBlock(pBuf, m_dwCurrentXRefSteam, iSize);
 
     ScopedFileStream file(FX_CreateMemoryStream(pBuf, (size_t)iSize, FALSE));
     m_parser.m_Syntax.InitParser(file.get(), 0);
 
     bool bNumber;
     CFX_ByteString objnum = m_parser.m_Syntax.GetNextWord(&bNumber);
     if (!bNumber)
       return -1;
 
-    FX_DWORD objNum = FXSYS_atoi(objnum);
+    FX_DWORD objNum = FXSYS_atoui(objnum);
     CPDF_Object* pObj = m_parser.ParseIndirectObjectAt(nullptr, 0, objNum);
     if (!pObj) {
       m_Pos += m_parser.m_Syntax.SavePos();
       return 0;
     }
 
     CPDF_Dictionary* pDict = pObj->GetDict();
     CPDF_Name* pName = ToName(pDict ? pDict->GetElement("Type") : nullptr);
     if (pName) {
       if (pName->GetString() == "XRef") {
@@ skipping 1312 matching lines @@
   CPDF_Array* pRange = m_pLinearizedDict->GetArrayBy("H");
   if (!pRange)
     return -1;
 
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
 
   return pStreamLen->GetInteger();
 }