Make sure the fuzzer read size does not go negative.

testing/libfuzzer/xfa_codec_fuzzer.h

 // Copyright 2016 The PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef TESTING_LIBFUZZER_XFA_CODEC_FUZZER_H_
 #define TESTING_LIBFUZZER_XFA_CODEC_FUZZER_H_
 
 #include <memory>
 
 #include "core/fxcodec/codec/ccodec_progressivedecoder.h"
@@ skipping 33 matching lines @@
   class Reader : public IFX_FileRead {
    public:
     Reader(const uint8_t* data, size_t size) : m_data(data), m_size(size) {}
     ~Reader() {}
 
     void Release() override {}
 
     FX_BOOL ReadBlock(void* buffer, FX_FILESIZE offset, size_t size) override {
       if (offset + size > m_size)
         size = m_size - offset;
+      if (offset > m_size)

[Lei Zhang, 2016/10/03 21:16:50]

Shouldn't we check this first in the function? Should we also check if offset <
0?

[dsinclair, 2016/10/04 13:11:07]

Done.

+        return FALSE;
       memcpy(buffer, m_data + offset, size);
       return TRUE;
     }
 
     FX_FILESIZE GetSize() override { return static_cast<FX_FILESIZE>(m_size); }
 
    private:
     const uint8_t* const m_data;
     size_t m_size;
   };
 };
 
 #endif  // TESTING_LIBFUZZER_XFA_CODEC_FUZZER_H_