Check first page number in CPDF_HintTables::ReadPageHintTable().

core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp

Index: core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
index fd8765a2d210aad572635feb1346fa53c72478c6..144c2dbe0b7c7886499d4dbdc6e64fe2c4caf3d3 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
@@ -165,6 +165,9 @@ bool CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
     return false;
 
   int nFirstPageNum = GetFirstPageNumber();
+  if (nFirstPageNum < 0)

[Tom Sepez, 2016/08/31 21:58:10]

Is there a reason this isn't just unsigned all the way down ...

[Lei Zhang, 2016/08/31 23:45:51]

PDF number objects have signed values.

+    return false;
+
   for (int i = 0; i < nPages; ++i) {
     if (i == nFirstPageNum) {
       m_szPageOffsetArray.push_back(m_szFirstPageObjOffset);