Guard against overflow when calculating font weight.

core/fpdfapi/fpdf_font/cpdf_simplefont.cpp

Index: core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
diff --git a/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp b/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
index 62d6959062ee2b3f353cccc1720326e32e839a52..a570bcd8b1c9de90a45262e29b7bfd1e319bb821 100644
--- a/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
@@ -10,6 +10,7 @@
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fxge/include/fx_freetype.h"
+#include "third_party/base/numerics/safe_math.h"
 
 CPDF_SimpleFont::CPDF_SimpleFont() : m_BaseEncoding(PDFFONT_ENCODING_BUILTIN) {
   FXSYS_memset(m_CharWidth, 0xff, sizeof(m_CharWidth));
@@ -181,9 +182,13 @@ void CPDF_SimpleFont::LoadSubstFont() {
       m_Flags |= PDFFONT_FIXEDPITCH;
     }
   }
-  int weight = m_StemV < 140 ? m_StemV * 5 : (m_StemV * 4 + 140);
-  m_Font.LoadSubst(m_BaseFont, IsTrueTypeFont(), m_Flags, weight, m_ItalicAngle,
-                   0);
+  pdfium::base::CheckedNumeric<int> safeStemV(m_StemV);

[npm, 2016/08/29 19:23:39]

Maybe you can also do something similar in CPDF_CIDFont::LoadSubstFont()

[dsinclair, 2016/08/29 19:40:55]

Done.

+  if (m_StemV < 140)
+    safeStemV *= 5;
+  else
+    safeStemV = safeStemV * 5 + 140;
+  m_Font.LoadSubst(m_BaseFont, IsTrueTypeFont(), m_Flags,
+                   safeStemV.ValueOrDefault(140), m_ItalicAngle, 0);

[dsinclair, 2016/08/29 19:15:43]

I made up 140 in here as it seemed to be the number we used in other bits ...

 }
 
 FX_BOOL CPDF_SimpleFont::IsUnicodeCompatible() const {