Use FX_SAFE_UINT32 on CPDF_ToUnicodeMap::Load

core/fpdfapi/fpdf_font/fpdf_font.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_font/font_int.h"
 
 #include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/fpdf_page/cpdf_form.h"
 #include "core/fpdfapi/fpdf_page/cpdf_pagemodule.h"
 #include "core/fpdfapi/fpdf_page/pageint.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_document.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_name.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_number.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_simple_parser.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_stream_acc.h"
 #include "core/fxcrt/fx_ext.h"
+#include "core/fxcrt/fx_safe_types.h"
 #include "core/fxge/fx_freetype.h"
 #include "third_party/base/numerics/safe_conversions.h"
 #include "third_party/base/stl_util.h"
 
 int TT2PDF(int m, FXFT_Face face) {
   int upm = FXFT_Get_Face_UnitsPerEM(face);
   if (upm == 0)
     return m;
   return pdfium::base::checked_cast<int>(
       (static_cast<double>(m) * 1000 + upm / 2) / upm);
@@ skipping 186 matching lines @@
         uint32_t srccode = StringToCode(word);
         word = parser.GetWord();
         CFX_WideString destcode = StringToWideString(word);
         int len = destcode.GetLength();
         if (len == 0) {
           continue;
         }
         if (len == 1) {
           m_Map[srccode] = destcode.GetAt(0);
         } else {
-          m_Map[srccode] = m_MultiCharBuf.GetLength() * 0x10000 + 0xffff;
+          FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
+          uni *= 0x10000;
+          uni += 0xffff;
+          m_Map[srccode] = uni.ValueOrDie();
           m_MultiCharBuf.AppendChar(destcode.GetLength());

[Tom Sepez, 2016/10/04 17:41:21]

Drive-by: do we prefer skipping/defaulting the value insteadof crashing here?

also uni = uni * 0x10000 + 0xffff; might be cleaner.

[npm, 2016/10/04 19:24:17]

I would say we prefer not crashing whenever possible because crashing is the
worst possible user experience... But not sure, maybe dsinclair@ knows?

[dsinclair, 2016/10/04 19:27:59]

Do we know what a sensible default should be? If there is a sensible value we
can return that might be better.

           m_MultiCharBuf << destcode;
         }
       }
     } else if (word == "beginbfrange") {
       while (1) {
         CFX_ByteString low, high;
         low = parser.GetWord();
         if (low.IsEmpty() || low == "endbfrange") {
           break;
         }
         high = parser.GetWord();
         uint32_t lowcode = StringToCode(low.AsStringC());
         uint32_t highcode =
             (lowcode & 0xffffff00) | (StringToCode(high.AsStringC()) & 0xff);
         if (highcode == (uint32_t)-1) {
           break;
         }
         CFX_ByteString start(parser.GetWord());
         if (start == "[") {
           for (uint32_t code = lowcode; code <= highcode; code++) {
             CFX_ByteString dest(parser.GetWord());
             CFX_WideString destcode = StringToWideString(dest.AsStringC());
             int len = destcode.GetLength();
             if (len == 0) {
               continue;
             }
             if (len == 1) {
               m_Map[code] = destcode.GetAt(0);
             } else {
-              m_Map[code] = m_MultiCharBuf.GetLength() * 0x10000 + 0xffff;
+              FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
+              uni *= 0x10000;
+              uni += 0xffff;
+              m_Map[code] = uni.ValueOrDie();
               m_MultiCharBuf.AppendChar(destcode.GetLength());
               m_MultiCharBuf << destcode;
             }
           }
           parser.GetWord();
         } else {
           CFX_WideString destcode = StringToWideString(start.AsStringC());
           int len = destcode.GetLength();
           uint32_t value = 0;
           if (len == 1) {
             value = StringToCode(start.AsStringC());
             for (uint32_t code = lowcode; code <= highcode; code++) {
               m_Map[code] = value++;
             }
           } else {
             for (uint32_t code = lowcode; code <= highcode; code++) {
               CFX_WideString retcode;
               if (code == lowcode) {
                 retcode = destcode;
               } else {
                 retcode = StringDataAdd(destcode);
               }
-              m_Map[code] = m_MultiCharBuf.GetLength() * 0x10000 + 0xffff;
+              FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();

[dsinclair, 2016/10/04 17:15:31]

Followup: These 6 lines are basically the same in the 3 chunks, can they be
factored out into a helper?

[npm, 2016/10/04 19:24:17]

Sounds good

+              uni *= 0x10000;
+              uni += 0xffff;
+              m_Map[code] = uni.ValueOrDie();
               m_MultiCharBuf.AppendChar(retcode.GetLength());
               m_MultiCharBuf << retcode;
               destcode = retcode;
             }
           }
         }
       }
     } else if (word == "/Adobe-Korea1-UCS2") {
       cid_set = CIDSET_KOREA1;
     } else if (word == "/Adobe-Japan1-UCS2") {
       cid_set = CIDSET_JAPAN1;
     } else if (word == "/Adobe-CNS1-UCS2") {
       cid_set = CIDSET_CNS1;
     } else if (word == "/Adobe-GB1-UCS2") {
       cid_set = CIDSET_GB1;
     }
   }
   if (cid_set) {
     m_pBaseMap = CPDF_ModuleMgr::Get()
                      ->GetPageModule()
                      ->GetFontGlobals()
                      ->m_CMapManager.GetCID2UnicodeMap(cid_set, FALSE);
   } else {
     m_pBaseMap = nullptr;
   }
 }