Guard against undefined shift.

xfa/fde/xml/fde_xml_imp.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fde/xml/fde_xml_imp.h"
 
 #include <algorithm>
 
 #include "core/fxcrt/include/fx_safe_types.h"
 #include "xfa/fgas/crt/fgas_codepage.h"
 #include "xfa/fgas/crt/fgas_system.h"
 
 namespace {
 
+const uint32_t kMaxCharRange = 0x10ffff;
+
 const uint16_t g_XMLValidCharRange[][2] = {{0x09, 0x09},
                                            {0x0A, 0x0A},
                                            {0x0D, 0x0D},
                                            {0x20, 0xD7FF},
                                            {0xE000, 0xFFFD}};
 
 bool FDE_IsXMLWhiteSpace(FX_WCHAR ch) {
   return ch == L' ' || ch == 0x0A || ch == 0x0D || ch == 0x09;
 }
 
@@ skipping 1804 matching lines @@
 
 FX_FILESIZE CFDE_XMLSyntaxParser::GetCurrentBinaryPos() const {
   if (!m_pStream)
     return 0;
 
   int32_t nSrcLen = m_pStart - m_pBuffer;
   int32_t nDstLen = FX_GetUTF8EncodeLength(m_pBuffer, nSrcLen);
   return m_iParsedBytes + nDstLen;
 }
 
-void CFDE_XMLSyntaxParser::ParseTextChar(FX_WCHAR ch) {
+void CFDE_XMLSyntaxParser::ParseTextChar(FX_WCHAR character) {
   if (m_iIndexInBlock == m_iAllocStep) {
     m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
     if (!m_pCurrentBlock) {
       return;
     }
   }
-  m_pCurrentBlock[m_iIndexInBlock++] = ch;
+  m_pCurrentBlock[m_iIndexInBlock++] = character;
   m_iDataLength++;
-  if (m_iEntityStart > -1 && ch == L';') {
+  if (m_iEntityStart > -1 && character == L';') {
     CFX_WideString csEntity;
     m_BlockBuffer.GetTextData(csEntity, m_iEntityStart + 1,
                               (m_iDataLength - 1) - m_iEntityStart - 1);
     int32_t iLen = csEntity.GetLength();
     if (iLen > 0) {
       if (csEntity[0] == L'#') {
-        ch = 0;
+        uint32_t ch = 0;
         FX_WCHAR w;
         if (iLen > 1 && csEntity[1] == L'x') {
           for (int32_t i = 2; i < iLen; i++) {
             w = csEntity[i];
             if (w >= L'0' && w <= L'9') {
               ch = (ch << 4) + w - L'0';
             } else if (w >= L'A' && w <= L'F') {
               ch = (ch << 4) + w - 55;
             } else if (w >= L'a' && w <= L'f') {
               ch = (ch << 4) + w - 87;
             } else {
               break;
             }
           }
         } else {
           for (int32_t i = 1; i < iLen; i++) {
             w = csEntity[i];
-            if (w < L'0' || w > L'9') {
+            if (w < L'0' || w > L'9')
               break;
-            }
             ch = ch * 10 + w - L'0';
           }
         }
-        if (ch != 0) {
-          m_BlockBuffer.SetTextChar(m_iEntityStart, ch);
+        if (ch > kMaxCharRange)
+          ch = ' ';
+
+        character = static_cast<FX_WCHAR>(ch);
+        if (character != 0) {
+          m_BlockBuffer.SetTextChar(m_iEntityStart, character);
           m_iEntityStart++;
         }
       } else {
         if (csEntity.Compare(L"amp") == 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, L'&');
           m_iEntityStart++;
         } else if (csEntity.Compare(L"lt") == 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, L'<');
           m_iEntityStart++;
         } else if (csEntity.Compare(L"gt") == 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, L'>');
           m_iEntityStart++;
         } else if (csEntity.Compare(L"apos") == 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, L'\'');
           m_iEntityStart++;
         } else if (csEntity.Compare(L"quot") == 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, L'\"');
           m_iEntityStart++;
         }
       }
     }
     m_BlockBuffer.DeleteTextChars(m_iDataLength - m_iEntityStart, FALSE);
     m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
     m_iEntityStart = -1;
   } else {
-    if (m_iEntityStart < 0 && ch == L'&') {
+    if (m_iEntityStart < 0 && character == L'&') {
       m_iEntityStart = m_iDataLength - 1;
     }
   }
   m_pStart++;
 }