Added bounds checking to GetNameFromTT to handle corrupt files.

core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits.h>
 
 #include "core/fpdfapi/fpdf_font/include/cpdf_font.h"
 #include "core/fpdfapi/fpdf_font/include/cpdf_fontencoding.h"
@@ skipping 216 matching lines @@
   }
   FXSYS_strcpy(lfa.lfFaceName, face.c_str());
   return AddWindowsFont(&lfa, bVert, bTranslateName);
 }
 CFX_ByteString _FPDF_GetPSNameFromTT(HDC hDC) {
   CFX_ByteString result;
   DWORD size = ::GetFontData(hDC, 'eman', 0, NULL, 0);
   if (size != GDI_ERROR) {
     LPBYTE buffer = FX_Alloc(BYTE, size);
     ::GetFontData(hDC, 'eman', 0, buffer, size);
-    result = GetNameFromTT(buffer, 6);
+    result = GetNameFromTT(buffer, size, 6);
     FX_Free(buffer);
   }
   return result;
 }
 CPDF_Font* CPDF_Document::AddWindowsFont(LOGFONTA* pLogFont,
                                          FX_BOOL bVert,
                                          FX_BOOL bTranslateName) {
   pLogFont->lfHeight = -1000;
   pLogFont->lfWidth = 0;
   HGDIOBJ hFont = CreateFontIndirectA(pLogFont);
@@ skipping 902 matching lines @@
 void FPDFAPI_FlatPageAttr(CPDF_Dictionary* pPageDict,
                           const CFX_ByteStringC& name) {
   if (pPageDict->KeyExist(name)) {
     return;
   }
   CPDF_Object* pObj = FPDFAPI_GetPageAttr(pPageDict, name);
   if (pObj) {
     pPageDict->SetAt(name, pObj->Clone());
   }
 }