Added bounds checking to GetNameFromTT to handle corrupt files.

core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp

Index: core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
diff --git a/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp b/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
index 7688bb08ce7e51d4603a7a14affa4c1d26ed72ea..cf79fdc47dc116f3be7f5598fda889520c02ce6c 100644
--- a/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
+++ b/core/fpdfapi/fpdf_edit/fpdf_edit_doc.cpp
@@ -234,7 +234,7 @@ CFX_ByteString _FPDF_GetPSNameFromTT(HDC hDC) {
   if (size != GDI_ERROR) {
     LPBYTE buffer = FX_Alloc(BYTE, size);
     ::GetFontData(hDC, 'eman', 0, buffer, size);
-    result = GetNameFromTT(buffer, 6);
+    result = GetNameFromTT(buffer, size, 6);
     FX_Free(buffer);
   }
   return result;