Check first page number in CPDF_HintTables::ReadPageHintTable().

core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/cpdf_hint_tables.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_data_avail.h"
@@ skipping 147 matching lines @@
       return false;
 
     dwPageLenArray.push_back(safePageLen.ValueOrDie());
   }
 
   int nOffsetE = GetEndOfFirstPageOffset();
   if (nOffsetE < 0)
     return false;
 
   int nFirstPageNum = GetFirstPageNumber();
+  if (nFirstPageNum < 0 || nFirstPageNum > std::numeric_limits<int>::max() - 1)
+    return false;
+
   for (int i = 0; i < nPages; ++i) {
     if (i == nFirstPageNum) {
       m_szPageOffsetArray.push_back(m_szFirstPageObjOffset);
     } else if (i == nFirstPageNum + 1) {
       if (i == 1) {
         m_szPageOffsetArray.push_back(nOffsetE);
       } else {
         m_szPageOffsetArray.push_back(m_szPageOffsetArray[i - 2] +
                                       dwPageLenArray[i - 2]);
       }
@@ skipping 166 matching lines @@
 
   hStream->ByteAlign();
   if (hStream->BitsRemaining() < dwSharedObjTotal)
     return false;
 
   hStream->SkipBits(dwSharedObjTotal);
   hStream->ByteAlign();
   return true;
 }
 
 bool CPDF_HintTables::GetPagePos(int index,

[Tom Sepez, 2016/09/01 00:06:51]

nit: can index at least be unsigned?

[Lei Zhang, 2016/09/01 00:11:30]

Maybe. I will in a separate CL. Need to check the callers. (and their callers
for CheckPage()).

                                  FX_FILESIZE* szPageStartPos,
                                  FX_FILESIZE* szPageLength,
                                  uint32_t* dwObjNum) {
+  if (index < 0)
+    return false;
+
   *szPageStartPos = m_szPageOffsetArray[index];
   *szPageLength = GetItemLength(index, m_szPageOffsetArray);
 
   int nFirstPageObjNum = GetFirstPageObjectNumber();
   if (nFirstPageObjNum < 0)
     return false;
 
   int nFirstPageNum = GetFirstPageNumber();
+  if (nFirstPageNum < 0)
+    return false;
+
   if (index == nFirstPageNum) {
     *dwObjNum = nFirstPageObjNum;
     return true;
   }
 
   // The object number of remaining pages starts from 1.
   *dwObjNum = 1;
   for (int i = 0; i < index; ++i) {
     if (i == nFirstPageNum)
       continue;
     *dwObjNum += m_dwDeltaNObjsArray[i];
   }
   return true;
 }
 
 CPDF_DataAvail::DocAvailStatus CPDF_HintTables::CheckPage(
     int index,
     CPDF_DataAvail::DownloadHints* pHints) {

[Tom Sepez, 2016/09/01 00:06:51]

nit: same here.

-  if (!pHints)
+  if (!pHints || index < 0)
     return CPDF_DataAvail::DataError;
 
-  int nFirstAvailPage = GetFirstPageNumber();
-  if (index == nFirstAvailPage)
+  if (index == GetFirstPageNumber())
     return CPDF_DataAvail::DataAvailable;
 
   uint32_t dwLength = GetItemLength(index, m_szPageOffsetArray);
   // If two pages have the same offset, it should be treated as an error.
   if (!dwLength)
     return CPDF_DataAvail::DataError;
 
   if (!m_pDataAvail->IsDataAvail(m_szPageOffsetArray[index], dwLength, pHints))
     return CPDF_DataAvail::DataNotAvailable;
 
@@ skipping 98 matching lines @@
 }
 
 int CPDF_HintTables::ReadPrimaryHintStream(int index) const {
   CPDF_Array* pRange = m_pLinearizedDict->GetArrayBy("H");
   if (!pRange)
     return -1;
 
   CPDF_Object* pStreamLen = pRange->GetDirectObjectAt(index);
   return pStreamLen ? pStreamLen->GetInteger() : -1;
 }