Reject JBig2 Huffman table with too large shift value

core/fxcodec/jbig2/JBig2_HuffmanTable.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_HuffmanTable.h"
 
 #include <algorithm>
 #include <vector>
@@ skipping 46 matching lines @@
 
   const int low = static_cast<int>(HTLOW);
   const int high = static_cast<int>(HTHIGH);
   if (low > high)
     return false;
 
   ExtendBuffers(false);
   int cur_low = low;
   do {
     if ((pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1) ||
-        (pStream->readNBits(HTRS, &RANGELEN[NTEMP]) == -1)) {
+        (pStream->readNBits(HTRS, &RANGELEN[NTEMP]) == -1) ||
+        (static_cast<size_t>(RANGELEN[NTEMP]) >= 8 * sizeof(cur_low))) {
       return false;
     }
     RANGELOW[NTEMP] = cur_low;
     cur_low += (1 << RANGELEN[NTEMP]);
     ExtendBuffers(true);
   } while (cur_low < high);
 
   if (pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1)
     return false;
 
@@ skipping 49 matching lines @@
   size_t size = PREFLEN.size();
   if (NTEMP < size)
     return;
 
   size += 16;
   ASSERT(NTEMP < size);
   PREFLEN.resize(size);
   RANGELEN.resize(size);
   RANGELOW.resize(size);
 }