Check for overflow in CMap_GetCode.

core/fpdfapi/fpdf_font/fpdf_font_cid_unittest.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/fpdfapi/fpdf_font/font_int.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace {
 
 bool uint_ranges_equal(uint8_t* a, uint8_t* b, size_t count) {
@@ skipping 10 matching lines @@
   EXPECT_EQ(0u, CPDF_CMapParser::CMap_GetCode(""));
   EXPECT_EQ(0u, CPDF_CMapParser::CMap_GetCode("<"));
   EXPECT_EQ(194u, CPDF_CMapParser::CMap_GetCode("<c2"));
   EXPECT_EQ(162u, CPDF_CMapParser::CMap_GetCode("<A2"));
   EXPECT_EQ(2802u, CPDF_CMapParser::CMap_GetCode("<Af2"));
   EXPECT_EQ(162u, CPDF_CMapParser::CMap_GetCode("<A2z"));
 
   EXPECT_EQ(12u, CPDF_CMapParser::CMap_GetCode("12"));
   EXPECT_EQ(12u, CPDF_CMapParser::CMap_GetCode("12d"));
   EXPECT_EQ(128u, CPDF_CMapParser::CMap_GetCode("128"));
+
+  // Overflow a uint32_t.
+  EXPECT_EQ(0u, CPDF_CMapParser::CMap_GetCode("<FFFFFFFFa"));

[Tom Sepez, 2016/09/21 18:58:13]

nit: how about 100000000, the first thing that overflows.

[dsinclair, 2016/09/21 19:00:32]

Done.

+  EXPECT_EQ(4294967295u, CPDF_CMapParser::CMap_GetCode("<FFFFFFFF"));

[Tom Sepez, 2016/09/21 18:58:13]

nit: this should come before the case at line 33 since its smaller.

[dsinclair, 2016/09/21 19:00:32]

Done.

 }
 
 TEST(fpdf_font_cid, CMap_GetCodeRange) {
   CMap_CodeRange range;
 
   // Must start with a <
   EXPECT_FALSE(CPDF_CMapParser::CMap_GetCodeRange(range, "", ""));
   EXPECT_FALSE(CPDF_CMapParser::CMap_GetCodeRange(range, "A", ""));
 
   // m_CharSize must be <= 4
@@ skipping 15 matching lines @@
   EXPECT_EQ(1, range.m_CharSize);
   EXPECT_EQ(161, range.m_Lower[0]);
   EXPECT_EQ(243, range.m_Upper[0]);
 
   // The second string should return 0's if it is shorter
   EXPECT_TRUE(CPDF_CMapParser::CMap_GetCodeRange(range, "<a1>", ""));
   EXPECT_EQ(1, range.m_CharSize);
   EXPECT_EQ(161, range.m_Lower[0]);
   EXPECT_EQ(0, range.m_Upper[0]);
 }