Handle undefined shifts in CPDF_PSEngine.

core/fpdfapi/page/fpdf_page_func.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/page/pageint.h"
 
 #include <limits.h>
 
@@ skipping 325 matching lines @@
       i2 = (int)Pop();
       Push(i1 ^ i2);
       break;
     case PSOP_NOT:
       i1 = (int)Pop();
       Push((int)!i1);
       break;
     case PSOP_BITSHIFT: {
       int shift = (int)Pop();
       int i = (int)Pop();
-      if (shift > 0) {
+      if (shift < -31 || shift > 31)

[Tom Sepez, 2016/10/12 20:17:58]

http://en.cppreference.com/w/cpp/language/operator_arithmetic

Plucking out the C++11 sections, 

For signed and positive a, the value of a << b is a * 2b if it is representable
the return type, otherwise the behavior is undefined.	
For negative a, the behavior of a << b is undefined.

So there are still cases where this might be flagged.  It's pretty much
impossible to check this properly :( ...

The only way to do this, it would seem, is to use int64_t 
(which is how the safe_int packages handles this?)

+        Push(0);
+      else if (shift >= 0)
         Push(i << shift);
-      } else {
+      else
         Push(i >> -shift);
-      }
       break;
     }
     case PSOP_TRUE:
       Push(1);
       break;
     case PSOP_FALSE:
       Push(0);
       break;
     case PSOP_POP:
       Pop();
@@ skipping 491 matching lines @@
   return m_Type == Type::kType2ExpotentialInterpolation
              ? static_cast<const CPDF_ExpIntFunc*>(this)
              : nullptr;
 }
 
 const CPDF_StitchFunc* CPDF_Function::ToStitchFunc() const {
   return m_Type == Type::kType3Stitching
              ? static_cast<const CPDF_StitchFunc*>(this)
              : nullptr;
 }