Make sure the fuzzer read size does not go negative.

testing/libfuzzer/xfa_codec_fuzzer.h

Index: testing/libfuzzer/xfa_codec_fuzzer.h
diff --git a/testing/libfuzzer/xfa_codec_fuzzer.h b/testing/libfuzzer/xfa_codec_fuzzer.h
index 6a84ed85725939eb030880f2652dc739dcd085f2..dea079b7111e4bb5c226d774d8738784bdb2b808 100644
--- a/testing/libfuzzer/xfa_codec_fuzzer.h
+++ b/testing/libfuzzer/xfa_codec_fuzzer.h
@@ -51,6 +51,8 @@ class XFACodecFuzzer {
     FX_BOOL ReadBlock(void* buffer, FX_FILESIZE offset, size_t size) override {
       if (offset + size > m_size)
         size = m_size - offset;
+      if (offset > m_size)

[Lei Zhang, 2016/10/03 21:16:50]

Shouldn't we check this first in the function? Should we also check if offset <
0?

[dsinclair, 2016/10/04 13:11:07]

Done.

+        return FALSE;
       memcpy(buffer, m_data + offset, size);
       return TRUE;
     }