Guard against overflow when calculating font weight.

core/fpdfapi/fpdf_font/cpdf_cidfont.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_font/cpdf_cidfont.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "core/fpdfapi/fpdf_cmaps/cmap_int.h"
 #include "core/fpdfapi/fpdf_font/font_int.h"
 #include "core/fpdfapi/fpdf_font/include/cpdf_fontencoding.h"
 #include "core/fpdfapi/fpdf_font/ttgsubtable.h"
 #include "core/fpdfapi/fpdf_page/cpdf_pagemodule.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream_acc.h"
 #include "core/fpdfapi/include/cpdf_modulemgr.h"
+#include "third_party/base/numerics/safe_math.h"
 
 namespace {
 
 const uint16_t g_CharsetCPs[CIDSET_NUM_SETS] = {0, 936, 950, 932, 949, 1200};
 
 const struct CIDTransform {
   uint16_t cid;
   uint8_t a;
   uint8_t b;
   uint8_t c;
@@ skipping 730 matching lines @@
   return m_pCMap->AppendChar(str, charcode);
 }
 
 FX_BOOL CPDF_CIDFont::IsUnicodeCompatible() const {
   if (m_pCID2UnicodeMap && m_pCID2UnicodeMap->IsLoaded() && m_pCMap->IsLoaded())
     return TRUE;
   return m_pCMap->m_Coding != CIDCODING_UNKNOWN;
 }
 
 void CPDF_CIDFont::LoadSubstFont() {
-  m_Font.LoadSubst(m_BaseFont, !m_bType1, m_Flags, m_StemV * 5, m_ItalicAngle,
+  pdfium::base::CheckedNumeric<int> safeStemV(m_StemV);
+  safeStemV *= 5;
+  m_Font.LoadSubst(m_BaseFont, !m_bType1, m_Flags,
+                   safeStemV.ValueOrDefault(FXFONT_FW_NORMAL), m_ItalicAngle,
                    g_CharsetCPs[m_Charset], IsVertWriting());
 }
 
 void CPDF_CIDFont::LoadMetricsArray(CPDF_Array* pArray,
                                     CFX_ArrayTemplate<uint32_t>& result,
                                     int nElements) {
   int width_status = 0;
   int iCurElement = 0;
   int first_code = 0;
   int last_code = 0;
@@ skipping 64 matching lines @@
 const uint8_t* CPDF_CIDFont::GetCIDTransform(uint16_t CID) const {
   if (m_Charset != CIDSET_JAPAN1 || m_pFontFile)
     return nullptr;
 
   const auto* pEnd = g_Japan1_VertCIDs + FX_ArraySize(g_Japan1_VertCIDs);
   const auto* pTransform = std::lower_bound(
       g_Japan1_VertCIDs, pEnd, CID,
       [](const CIDTransform& entry, uint16_t cid) { return entry.cid < cid; });
   return pTransform < pEnd && CID == pTransform->cid ? &pTransform->a : nullptr;
 }