Guard against overflow when calculating font weight.

core/fpdfapi/fpdf_font/cpdf_cidfont.cpp

Index: core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
diff --git a/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp b/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
index 491bd6d0c7895c70e4a67efb93cc1f8681139022..d3b57859914270e16f065e59c0f766103427ce64 100644
--- a/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
@@ -18,6 +18,7 @@
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream_acc.h"
 #include "core/fpdfapi/include/cpdf_modulemgr.h"
+#include "third_party/base/numerics/safe_math.h"
 
 namespace {
 
@@ -768,7 +769,10 @@ FX_BOOL CPDF_CIDFont::IsUnicodeCompatible() const {
 }
 
 void CPDF_CIDFont::LoadSubstFont() {
-  m_Font.LoadSubst(m_BaseFont, !m_bType1, m_Flags, m_StemV * 5, m_ItalicAngle,
+  pdfium::base::CheckedNumeric<int> safeStemV(m_StemV);
+  safeStemV *= 5;
+  m_Font.LoadSubst(m_BaseFont, !m_bType1, m_Flags,
+                   safeStemV.ValueOrDefault(140), m_ItalicAngle,

[Wei Li, 2016/08/29 23:05:48]

Maybe it is worth defining a constant for the default value if not using the
existing one.

[dsinclair, 2016/08/30 14:26:39]

Went with FXFONT_FW_NORMAL.

                    g_CharsetCPs[m_Charset], IsVertWriting());
 }