Add some limit checks to ReadSharedObjHintTable().

core/fpdfapi/fpdf_parser/cpdf_parser.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h"
 
 #include <vector>
 
@@ skipping 11 matching lines @@
 #include "core/fxcrt/include/fx_ext.h"
 #include "core/fxcrt/include/fx_safe_types.h"
 #include "third_party/base/stl_util.h"
 
 namespace {
 
 // A limit on the size of the xref table. Theoretical limits are higher, but
 // this may be large enough in practice.
 const int32_t kMaxXRefSize = 1048576;
 
-// A limit on the maximum object number in the xref table. Theoretical limits
-// are higher, but this may be large enough in practice.
-const uint32_t kMaxObjectNumber = 1048576;
-
 uint32_t GetVarInt(const uint8_t* p, int32_t n) {
   uint32_t result = 0;
   for (int32_t i = 0; i < n; ++i)
     result = result * 256 + p[i];
   return result;
 }
 
 int32_t GetStreamNCount(CPDF_StreamAcc* pObjStream) {
   return pObjStream->GetDict()->GetIntegerBy("N");
 }
@@ skipping 1615 matching lines @@
   if (!LoadLinearizedAllCrossRefV4(m_LastXRefOffset, m_dwXrefStartObjNum) &&
       !LoadLinearizedAllCrossRefV5(m_LastXRefOffset)) {
     m_LastXRefOffset = 0;
     m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum;
     return FORMAT_ERROR;
   }
 
   m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum;
   return SUCCESS;
 }