Check for overflow in CMap_GetCode.

core/fpdfapi/fpdf_font/fpdf_font_cid.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_font/font_int.h"
 
 #include "core/fpdfapi/fpdf_cmaps/cmap_int.h"
 #include "core/fpdfapi/fpdf_font/ttgsubtable.h"
@@ skipping 423 matching lines @@
         }
       }
       m_CodeSeq++;
     }
   }
   m_LastWord = word;
 }
 
 // Static.
 uint32_t CPDF_CMapParser::CMap_GetCode(const CFX_ByteStringC& word) {
-  int num = 0;
+  pdfium::base::CheckedNumeric<uint32_t> num = 0;
   if (word.GetAt(0) == '<') {
-    for (int i = 1; i < word.GetLength() && std::isxdigit(word.GetAt(i)); ++i)
+    for (int i = 1; i < word.GetLength() && std::isxdigit(word.GetAt(i)); ++i) {
       num = num * 16 + FXSYS_toHexDigit(word.GetAt(i));
-    return num;
+      if (!num.IsValid())
+        return 0;
+    }
+    return num.ValueOrDie();
   }
 
-  for (int i = 0; i < word.GetLength() && std::isdigit(word.GetAt(i)); ++i)
+  for (int i = 0; i < word.GetLength() && std::isdigit(word.GetAt(i)); ++i) {
     num = num * 10 + FXSYS_toDecimalDigit(static_cast<FX_WCHAR>(word.GetAt(i)));
-  return num;
+    if (!num.IsValid())
+      return 0;
+  }
+  return num.ValueOrDie();
 }
 
 // Static.
 bool CPDF_CMapParser::CMap_GetCodeRange(CMap_CodeRange& range,
                                         const CFX_ByteStringC& first,
                                         const CFX_ByteStringC& second) {
   if (first.GetLength() == 0 || first.GetAt(0) != '<')
     return false;
 
   int i;
@@ skipping 310 matching lines @@
   m_EmbeddedCount = pFontGlobals->m_EmbeddedToUnicodes[charset].m_Count;
 }
 
 CIDSet CharsetFromOrdering(const CFX_ByteStringC& ordering) {
   for (size_t charset = 1; charset < FX_ArraySize(g_CharsetNames); ++charset) {
     if (ordering == g_CharsetNames[charset])
       return CIDSetFromSizeT(charset);
   }
   return CIDSET_UNKNOWN;
 }