Check the hint table exists before using.

core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/ipdf_data_avail.h"
 
 #include "core/fpdfapi/fpdf_parser/cpdf_data_avail.h"
 #include "core/fpdfapi/fpdf_parser/fpdf_parser_utility.h"
@@ skipping 730 matching lines @@
     return FALSE;
   }
 
   int nPageCount = pDict->GetDirectObjectBy("N")->GetInteger();
   if (nPageCount <= 1) {
     m_docStatus = PDF_DATAAVAIL_DONE;
     return TRUE;
   }
 
   CPDF_Array* pHintStreamRange = pDict->GetArrayBy("H");
+  if (!pHintStreamRange)

[Lei Zhang, 2016/06/08 01:40:53]

In the bug, you mentioned this code infinite loops with the given test case. You
probably should add: m_docStatus = PDF_DATAAVAIL_ERROR - same treatment as if
the "H" key does not exist on line 739.

+    return FALSE;
+
   FX_FILESIZE szHSStart =
       pHintStreamRange->GetDirectObjectAt(0)
           ? pHintStreamRange->GetDirectObjectAt(0)->GetInteger()
           : 0;
   FX_FILESIZE szHSLength =
       pHintStreamRange->GetDirectObjectAt(1)
           ? pHintStreamRange->GetDirectObjectAt(1)->GetInteger()
           : 0;
   if (szHSStart < 0 || szHSLength <= 0) {
     m_docStatus = PDF_DATAAVAIL_ERROR;
@@ skipping 1068 matching lines @@
   return FormAvailable;
 }
 
 CPDF_DataAvail::PageNode::PageNode() : m_type(PDF_PAGENODE_UNKNOWN) {}
 
 CPDF_DataAvail::PageNode::~PageNode() {
   for (int32_t i = 0; i < m_childNode.GetSize(); ++i)
     delete m_childNode[i];
   m_childNode.RemoveAll();
 }