Fixup crypto key generation.

core/fpdfapi/fpdf_parser/cpdf_crypto_handler.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/cpdf_crypto_handler.h"
 
 #include <time.h>
 
@@ skipping 10 matching lines @@
                                     uint8_t* dest_buf,
                                     uint32_t& dest_size) {
   if (m_Cipher == FXCIPHER_NONE) {
     FXSYS_memcpy(dest_buf, src_buf, src_size);
     return;
   }
   uint8_t realkey[16];
   int realkeylen = 16;
   if (m_Cipher != FXCIPHER_AES || m_KeyLen != 32) {
     uint8_t key1[32];
-    FXSYS_memcpy(key1, m_EncryptKey, m_KeyLen);
-    key1[m_KeyLen + 0] = (uint8_t)objnum;
-    key1[m_KeyLen + 1] = (uint8_t)(objnum >> 8);
-    key1[m_KeyLen + 2] = (uint8_t)(objnum >> 16);
-    key1[m_KeyLen + 3] = (uint8_t)gennum;
-    key1[m_KeyLen + 4] = (uint8_t)(gennum >> 8);
-    FXSYS_memcpy(key1 + m_KeyLen, &objnum, 3);
-    FXSYS_memcpy(key1 + m_KeyLen + 3, &gennum, 2);
+    PopulateKey(objnum, gennum, key1);
+
     if (m_Cipher == FXCIPHER_AES) {
       FXSYS_memcpy(key1 + m_KeyLen + 5, "sAlT", 4);
     }
     CRYPT_MD5Generate(
         key1, m_Cipher == FXCIPHER_AES ? m_KeyLen + 9 : m_KeyLen + 5, realkey);
     realkeylen = m_KeyLen + 5;
     if (realkeylen > 16) {
       realkeylen = 16;
     }
   }
@@ skipping 51 matching lines @@
     CRYPT_AESSetKey(pContext->m_Context, 16, m_EncryptKey, 32, bEncrypt);
     if (bEncrypt) {
       for (int i = 0; i < 16; i++) {
         pContext->m_Block[i] = (uint8_t)rand();
       }
       CRYPT_AESSetIV(pContext->m_Context, pContext->m_Block);
     }
     return pContext;
   }
   uint8_t key1[48];
-  FXSYS_memcpy(key1, m_EncryptKey, m_KeyLen);
-  FXSYS_memcpy(key1 + m_KeyLen, &objnum, 3);
-  FXSYS_memcpy(key1 + m_KeyLen + 3, &gennum, 2);
+  PopulateKey(objnum, gennum, key1);
+
   if (m_Cipher == FXCIPHER_AES) {
     FXSYS_memcpy(key1 + m_KeyLen + 5, "sAlT", 4);
   }
   uint8_t realkey[16];
   CRYPT_MD5Generate(
       key1, m_Cipher == FXCIPHER_AES ? m_KeyLen + 9 : m_KeyLen + 5, realkey);
   int realkeylen = m_KeyLen + 5;
   if (realkeylen > 16) {
     realkeylen = 16;
   }
   if (m_Cipher == FXCIPHER_AES) {
     AESCryptContext* pContext = FX_Alloc(AESCryptContext, 1);
     pContext->m_bIV = TRUE;
     pContext->m_BlockOffset = 0;
     CRYPT_AESSetKey(pContext->m_Context, 16, realkey, 16, bEncrypt);
     if (bEncrypt) {
       for (int i = 0; i < 16; i++) {
         pContext->m_Block[i] = (uint8_t)rand();
       }
       CRYPT_AESSetIV(pContext->m_Context, pContext->m_Block);
     }
     return pContext;
   }
   void* pContext = FX_Alloc(uint8_t, 1040);
   CRYPT_ArcFourSetup(pContext, realkey, realkeylen);
   return pContext;
 }
+
 FX_BOOL CPDF_CryptoHandler::CryptStream(void* context,
                                         const uint8_t* src_buf,
                                         uint32_t src_size,
                                         CFX_BinaryBuf& dest_buf,
                                         FX_BOOL bEncrypt) {
   if (!context) {
     return FALSE;
   }
   if (m_Cipher == FXCIPHER_NONE) {
     dest_buf.AppendBlock(src_buf, src_size);
@@ skipping 178 matching lines @@
   return TRUE;
 }
 CPDF_CryptoHandler::CPDF_CryptoHandler() {
   m_pAESContext = nullptr;
   m_Cipher = FXCIPHER_NONE;
   m_KeyLen = 0;
 }
 CPDF_CryptoHandler::~CPDF_CryptoHandler() {
   FX_Free(m_pAESContext);
 }
+
+void CPDF_CryptoHandler::PopulateKey(uint32_t objnum,
+                                     uint32_t gennum,
+                                     uint8_t* key) {
+  FXSYS_memcpy(key, m_EncryptKey, m_KeyLen);
+  key[m_KeyLen + 0] = (uint8_t)objnum;
+  key[m_KeyLen + 1] = (uint8_t)(objnum >> 8);
+  key[m_KeyLen + 2] = (uint8_t)(objnum >> 16);
+  key[m_KeyLen + 3] = (uint8_t)gennum;
+  key[m_KeyLen + 4] = (uint8_t)(gennum >> 8);
+}