Added bounds checking to GetNameFromTT to handle corrupt files.

core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp

Index: core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
diff --git a/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp b/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
index 2fddf10a7898efbcad33523e845e8efc130d08ff..82a0b9b0938e1447337357c05f475616ddd3f594 100644
--- a/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
+++ b/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
@@ -232,7 +232,7 @@ CFX_ByteString _FPDF_GetPSNameFromTT(HDC hDC) {
   if (size != GDI_ERROR) {
     LPBYTE buffer = FX_Alloc(BYTE, size);
     ::GetFontData(hDC, 'eman', 0, buffer, size);
-    result = GetNameFromTT(buffer, 6);
+    result = GetNameFromTT(buffer, size, 6);
     FX_Free(buffer);
   }
   return result;