| Index: core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| index dfb34cbd588d1f38850bc078f87b4d9e46abeecc..fd723a8fa802f404b6e4d150ef92388eb2767b67 100644
|
| --- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| +++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| @@ -428,6 +428,9 @@ FX_BOOL CPDF_HintTables::LoadHintStream(CPDF_Stream* pHintStream) {
|
| return FALSE;
|
|
|
| int shared_hint_table_offset = pOffset->GetInteger();
|
| + if (shared_hint_table_offset <= 0)
|
| + return FALSE;
|
| +
|
| CPDF_StreamAcc acc;
|
| acc.LoadAllData(pHintStream);
|
|
|
| @@ -435,17 +438,20 @@ FX_BOOL CPDF_HintTables::LoadHintStream(CPDF_Stream* pHintStream) {
|
| // The header section of page offset hint table is 36 bytes.
|
| // The header section of shared object hint table is 24 bytes.
|
| // Hint table has at least 60 bytes.
|
| - const uint32_t MIN_STREAM_LEN = 60;
|
| - if (size < MIN_STREAM_LEN || shared_hint_table_offset <= 0 ||
|
| - size < static_cast<uint32_t>(shared_hint_table_offset)) {
|
| + const uint32_t kMinStreamLength = 60;
|
| + if (size < kMinStreamLength)
|
| + return FALSE;
|
| +
|
| + FX_SAFE_UINT32 safe_shared_hint_table_offset = shared_hint_table_offset;
|
| + if (!safe_shared_hint_table_offset.IsValid() ||
|
| + size < safe_shared_hint_table_offset.ValueOrDie()) {
|
| return FALSE;
|
| }
|
|
|
| CFX_BitStream bs;
|
| bs.Init(acc.GetData(), size);
|
| return ReadPageHintTable(&bs) &&
|
| - ReadSharedObjHintTable(&bs, pdfium::base::checked_cast<uint32_t>(
|
| - shared_hint_table_offset));
|
| + ReadSharedObjHintTable(&bs, shared_hint_table_offset);
|
| }
|
|
|
| int CPDF_HintTables::ReadPrimaryHintStreamOffset() const {
|
|
|