Guard against undefined shift.

xfa/fde/xml/fde_xml_imp.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fde/xml/fde_xml_imp.h"
 
 #include <algorithm>
 
@@ skipping 1850 matching lines @@
             w = csEntity[i];
             if (w >= L'0' && w <= L'9') {
               ch = (ch << 4) + w - L'0';
             } else if (w >= L'A' && w <= L'F') {
               ch = (ch << 4) + w - 55;
             } else if (w >= L'a' && w <= L'f') {
               ch = (ch << 4) + w - 87;
             } else {
               break;
             }
+            if (ch < 0) {

[Wei Li, 2016/08/08 22:38:52]

Should we check overflow instead of being negative?
Maybe we can check the number of non-zero wchar, which should be no more than 4,
right?

[dsinclair, 2016/08/09 00:21:51]

I can switch to using overflow checking, will change the code tomorrow. I think
the windows test will still need to be special cased as it doesn't overflow a
windows wchar_t, but this code will be nicer.

Not sure what you mean by checking the non-zero wchar?

[dsinclair, 2016/08/09 14:33:33]

I tried the checked numeric but I'd also still need the < 0 check. The wchar_t
signedness is undefined by the spec. So, it happens that Linux leaves it as
signed, so the CheckedNumeric doesn't overflow, but the shift still fails.

+              ch = ' ';
+              break;
+            }
           }
         } else {
           for (int32_t i = 1; i < iLen; i++) {
             w = csEntity[i];
-            if (w < L'0' || w > L'9') {
+            if (w < L'0' || w > L'9')
+              break;
+            ch = ch * 10 + w - L'0';
+
+            if (ch < 0) {
+              ch = ' ';
               break;
             }
-            ch = ch * 10 + w - L'0';
           }
         }
         if (ch != 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, ch);
           m_iEntityStart++;
         }
       } else {
         if (csEntity.Compare(L"amp") == 0) {
           m_BlockBuffer.SetTextChar(m_iEntityStart, L'&');
           m_iEntityStart++;
@@ skipping 15 matching lines @@
     m_BlockBuffer.DeleteTextChars(m_iDataLength - m_iEntityStart, FALSE);
     m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
     m_iEntityStart = -1;
   } else {
     if (m_iEntityStart < 0 && ch == L'&') {
       m_iEntityStart = m_iDataLength - 1;
     }
   }
   m_pStart++;
 }