Add some limit checks to ReadSharedObjHintTable().

core/fpdfapi/fpdf_parser/include/cpdf_parser.h

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_FPDFAPI_FPDF_PARSER_INCLUDE_CPDF_PARSER_H_
 #define CORE_FPDFAPI_FPDF_PARSER_INCLUDE_CPDF_PARSER_H_
 
 #include <map>
@@ skipping 16 matching lines @@
 class CPDF_Parser {
  public:
   enum Error {
     SUCCESS = 0,
     FILE_ERROR,
     FORMAT_ERROR,
     PASSWORD_ERROR,
     HANDLER_ERROR
   };
 
+  // A limit on the maximum object number in the xref table. Theoretical limits
+  // are higher, but this may be large enough in practice.
+  static const uint32_t kMaxObjectNumber = 1048576;
+
   CPDF_Parser();
   ~CPDF_Parser();
 
   Error StartParse(IFX_FileRead* pFile, CPDF_Document* pDocument);
   Error StartLinearizedParse(IFX_FileRead* pFile, CPDF_Document* pDocument);
 
   void SetPassword(const FX_CHAR* password) { m_Password = password; }
   CFX_ByteString GetPassword() { return m_Password; }
   CPDF_Dictionary* GetTrailer() const { return m_pTrailer; }
   FX_FILESIZE GetLastXRefOffset() const { return m_LastXRefOffset; }
@@ skipping 116 matching lines @@
   // Mapping of object numbers to offsets. The offsets are relative to the first
   // object in the stream.
   using StreamObjectCache = std::map<uint32_t, uint32_t>;
 
   // Mapping of streams to their object caches. This is valid as long as the
   // streams in |m_ObjectStreamMap| are valid.
   std::map<CPDF_StreamAcc*, StreamObjectCache> m_ObjCache;
 
   // All indirect object numbers that are being parsed.
   std::set<uint32_t> m_ParsingObjNums;
-
-
 };
 
 #endif  // CORE_FPDFAPI_FPDF_PARSER_INCLUDE_CPDF_PARSER_H_