Check first page number in CPDF_HintTables::ReadPageHintTable().

core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/cpdf_hint_tables.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_data_avail.h"
@@ skipping 147 matching lines @@
       return false;
 
     dwPageLenArray.push_back(safePageLen.ValueOrDie());
   }
 
   int nOffsetE = GetEndOfFirstPageOffset();
   if (nOffsetE < 0)
     return false;
 
   int nFirstPageNum = GetFirstPageNumber();
+  if (nFirstPageNum < 0)

[Tom Sepez, 2016/08/31 21:58:10]

Is there a reason this isn't just unsigned all the way down ...

[Lei Zhang, 2016/08/31 23:45:51]

PDF number objects have signed values.

+    return false;
+
   for (int i = 0; i < nPages; ++i) {
     if (i == nFirstPageNum) {
       m_szPageOffsetArray.push_back(m_szFirstPageObjOffset);
     } else if (i == nFirstPageNum + 1) {
       if (i == 1) {
         m_szPageOffsetArray.push_back(nOffsetE);
       } else {
         m_szPageOffsetArray.push_back(m_szPageOffsetArray[i - 2] +
                                       dwPageLenArray[i - 2]);
       }
@@ skipping 319 matching lines @@
 }
 
 int CPDF_HintTables::ReadPrimaryHintStream(int index) const {
   CPDF_Array* pRange = m_pLinearizedDict->GetArrayBy("H");
   if (!pRange)
     return -1;
 
   CPDF_Object* pStreamLen = pRange->GetDirectObjectAt(index);
   return pStreamLen ? pStreamLen->GetInteger() : -1;
 }