Avoid an undefined shift in ReadPageHintTable().

core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/cpdf_hint_tables.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_data_avail.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
@@ skipping 91 matching lines @@
 
   // Item 12: The number of bits needed to represent the numerator of
   // the fractional position for each shared object reference. For each
   // shared object referenced from a page, there is an indication of
   // where in the page's content stream the object is first referenced.
   uint32_t dwSharedNumeratorBits = hStream->GetBits(16);
 
   // Item 13: Skip Item 13 which has 16 bits.
   hStream->SkipBits(16);
 
+  // The maximum number of bits allowed to represent the greatest number of
+  // shared object references. 2^39 should be more than enough.
+  constexpr uint32_t kMaxSharedObjBits = 39;
+  if (dwSharedObjBits > kMaxSharedObjBits)
+    return FALSE;
+
   CPDF_Object* pPageNum = m_pLinearizedDict->GetDirectObjectBy("N");
   int nPages = pPageNum ? pPageNum->GetInteger() : 0;
   if (nPages < 1)
     return FALSE;
 
   FX_SAFE_UINT32 required_bits = dwDeltaObjectsBits;
   required_bits *= pdfium::base::checked_cast<uint32_t>(nPages);
   if (!CanReadFromBitStream(hStream, required_bits))
     return FALSE;
 
@@ skipping 357 matching lines @@
   CPDF_Array* pRange = m_pLinearizedDict->GetArrayBy("H");
   if (!pRange)
     return -1;
 
   CPDF_Object* pStreamLen = pRange->GetDirectObjectAt(1);
   if (!pStreamLen)
     return -1;
 
   return pStreamLen->GetInteger();
 }