Fix more integer overflows inside ReadPageHintTable().

core/fxcrt/fx_basic_buffer.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <algorithm>
 #include <limits>
 
 #include "core/fxcrt/include/fx_basic.h"
@@ skipping 169 matching lines @@
 CFX_WideTextBuf& CFX_WideTextBuf::operator<<(const CFX_WideTextBuf& buf) {
   AppendBlock(buf.m_pBuffer.get(), buf.m_DataSize);
   return *this;
 }
 
 void CFX_BitStream::Init(const uint8_t* pData, uint32_t dwSize) {
   m_pData = pData;
   m_BitSize = dwSize * 8;
   m_BitPos = 0;
 }
+
 void CFX_BitStream::ByteAlign() {
   int mod = m_BitPos % 8;

[Tom Sepez, 2016/08/23 00:09:16]

Is m_BitPos unsigned?  It should be.  Make |mod| match if needed.
Can't we do this without multiplications?  (x + 7) & ~7 or some such?

[Lei Zhang, 2016/08/23 00:33:12]

Uhh, wasn't looking that hard. Done.

-  if (mod == 0) {
-    return;
-  }
-  m_BitPos += 8 - mod;
+  if (mod)
+    m_BitPos += 8 - mod;
 }
+
 uint32_t CFX_BitStream::GetBits(uint32_t nBits) {
-  if (nBits > m_BitSize || m_BitPos + nBits > m_BitSize) {
+  if (nBits > m_BitSize || m_BitPos + nBits > m_BitSize)
     return 0;
-  }
+
   if (nBits == 1) {
     int bit = (m_pData[m_BitPos / 8] & (1 << (7 - m_BitPos % 8))) ? 1 : 0;
     m_BitPos++;
     return bit;
   }
+
   uint32_t byte_pos = m_BitPos / 8;
-  uint32_t bit_pos = m_BitPos % 8, bit_left = nBits;
+  uint32_t bit_pos = m_BitPos % 8;
+  uint32_t bit_left = nBits;
   uint32_t result = 0;
   if (bit_pos) {
     if (8 - bit_pos >= bit_left) {
       result =
           (m_pData[byte_pos] & (0xff >> bit_pos)) >> (8 - bit_pos - bit_left);
       m_BitPos += bit_left;
       return result;
     }
     bit_left -= 8 - bit_pos;
     result = (m_pData[byte_pos++] & ((1 << (8 - bit_pos)) - 1)) << bit_left;
   }
   while (bit_left >= 8) {
     bit_left -= 8;
     result |= m_pData[byte_pos++] << bit_left;
   }
-  if (bit_left) {
+  if (bit_left)
     result |= m_pData[byte_pos] >> (8 - bit_left);
-  }
   m_BitPos += nBits;
   return result;
 }
 
 CFX_FileBufferArchive::CFX_FileBufferArchive()
     : m_Length(0), m_pFile(nullptr) {}
 
 CFX_FileBufferArchive::~CFX_FileBufferArchive() {}
 
 void CFX_FileBufferArchive::Clear() {
   m_Length = 0;
   m_pBuffer.reset();
   m_pFile = nullptr;
 }
 
 bool CFX_FileBufferArchive::Flush() {
   size_t nRemaining = m_Length;
   m_Length = 0;
   if (!m_pFile)
     return false;
   if (!m_pBuffer || !nRemaining)
     return true;
   return m_pFile->WriteBlock(m_pBuffer.get(), nRemaining) > 0;
 }
 
 int32_t CFX_FileBufferArchive::AppendBlock(const void* pBuf, size_t size) {
-  if (!pBuf || size < 1) {
+  if (!pBuf || size < 1)
     return 0;
-  }
-  if (!m_pBuffer) {
+
+  if (!m_pBuffer)
     m_pBuffer.reset(FX_Alloc(uint8_t, kBufSize));
-  }
+
   const uint8_t* buffer = reinterpret_cast<const uint8_t*>(pBuf);
   size_t temp_size = size;
   while (temp_size) {
     size_t buf_size = std::min(kBufSize - m_Length, temp_size);
     FXSYS_memcpy(m_pBuffer.get() + m_Length, buffer, buf_size);
     m_Length += buf_size;
     if (m_Length == kBufSize) {
       if (!Flush()) {
         return -1;
       }
@@ skipping 15 matching lines @@
 }
 
 int32_t CFX_FileBufferArchive::AppendString(const CFX_ByteStringC& lpsz) {
   return AppendBlock(lpsz.raw_str(), lpsz.GetLength());
 }
 
 void CFX_FileBufferArchive::AttachFile(IFX_StreamWrite* pFile) {
   ASSERT(pFile);
   m_pFile = pFile;
 }