Guard against overflow when calculating font weight.

core/fpdfapi/fpdf_font/cpdf_simplefont.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_font/cpdf_simplefont.h"
 
 #include "core/fpdfapi/fpdf_font/font_int.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fxge/include/fx_freetype.h"
+#include "third_party/base/numerics/safe_math.h"
 
 CPDF_SimpleFont::CPDF_SimpleFont() : m_BaseEncoding(PDFFONT_ENCODING_BUILTIN) {
   FXSYS_memset(m_CharWidth, 0xff, sizeof(m_CharWidth));
   FXSYS_memset(m_GlyphIndex, 0xff, sizeof(m_GlyphIndex));
   FXSYS_memset(m_ExtGID, 0xff, sizeof(m_ExtGID));
   for (size_t i = 0; i < FX_ArraySize(m_CharBBox); ++i)
     m_CharBBox[i] = FX_RECT(-1, -1, -1, -1);
 }
 
 CPDF_SimpleFont::~CPDF_SimpleFont() {}
@@ skipping 151 matching lines @@
       if (width == 0) {
         width = m_CharWidth[i];
       } else if (width != m_CharWidth[i]) {
         break;
       }
     }
     if (i == 256 && width) {
       m_Flags |= PDFFONT_FIXEDPITCH;
     }
   }
-  int weight = m_StemV < 140 ? m_StemV * 5 : (m_StemV * 4 + 140);
-  m_Font.LoadSubst(m_BaseFont, IsTrueTypeFont(), m_Flags, weight, m_ItalicAngle,
-                   0);
+  pdfium::base::CheckedNumeric<int> safeStemV(m_StemV);

[npm, 2016/08/29 19:23:39]

Maybe you can also do something similar in CPDF_CIDFont::LoadSubstFont()

[dsinclair, 2016/08/29 19:40:55]

Done.

+  if (m_StemV < 140)
+    safeStemV *= 5;
+  else
+    safeStemV = safeStemV * 5 + 140;
+  m_Font.LoadSubst(m_BaseFont, IsTrueTypeFont(), m_Flags,
+                   safeStemV.ValueOrDefault(140), m_ItalicAngle, 0);

[dsinclair, 2016/08/29 19:15:43]

I made up 140 in here as it seemed to be the number we used in other bits ...

 }
 
 FX_BOOL CPDF_SimpleFont::IsUnicodeCompatible() const {
   return m_BaseEncoding != PDFFONT_ENCODING_BUILTIN &&
          m_BaseEncoding != PDFFONT_ENCODING_ADOBE_SYMBOL &&
          m_BaseEncoding != PDFFONT_ENCODING_ZAPFDINGBATS;
 }
 
 CFX_WideString CPDF_SimpleFont::UnicodeFromCharCode(uint32_t charcode) const {
   CFX_WideString unicode = CPDF_Font::UnicodeFromCharCode(charcode);
   if (!unicode.IsEmpty())
     return unicode;
   FX_WCHAR ret = m_Encoding.UnicodeFromCharCode((uint8_t)charcode);
   if (ret == 0)
     return CFX_WideString();
   return ret;
 }
 
 uint32_t CPDF_SimpleFont::CharCodeFromUnicode(FX_WCHAR unicode) const {
   uint32_t ret = CPDF_Font::CharCodeFromUnicode(unicode);
   if (ret)
     return ret;
   return m_Encoding.CharCodeFromUnicode(unicode);
 }