Handle undefined shifts in CPDF_PSEngine.

core/fpdfapi/page/fpdf_page_func.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/page/pageint.h"
 
 #include <limits.h>
 
@@ skipping 325 matching lines @@
       i2 = (int)Pop();
       Push(i1 ^ i2);
       break;
     case PSOP_NOT:
       i1 = (int)Pop();
       Push((int)!i1);
       break;
     case PSOP_BITSHIFT: {
       int shift = (int)Pop();
       int i = (int)Pop();
-      if (shift > 0) {
-        Push(i << shift);
-      } else {
-        Push(i >> -shift);
+      if (shift == 0) {
+        Push(i);
+        break;
       }
+      if (shift < -31 || shift > 31) {
+        Push(0);
+        break;
+      }
+      uint64_t unsigned_i = i;

[Tom Sepez, 2016/10/20 20:55:29]

think we want to do it as a signed64?

+      if (shift > 0)
+        unsigned_i <<= shift;
+      else
+        unsigned_i >>= shift;

[Tom Sepez, 2016/10/20 20:55:30]

need a -shift here?

+      Push(static_cast<int>(unsigned_i & 0xFFFFFFFF));
       break;
     }
     case PSOP_TRUE:
       Push(1);
       break;
     case PSOP_FALSE:
       Push(0);
       break;
     case PSOP_POP:
       Pop();
@@ skipping 491 matching lines @@
   return m_Type == Type::kType2ExpotentialInterpolation
              ? static_cast<const CPDF_ExpIntFunc*>(this)
              : nullptr;
 }
 
 const CPDF_StitchFunc* CPDF_Function::ToStitchFunc() const {
   return m_Type == Type::kType3Stitching
              ? static_cast<const CPDF_StitchFunc*>(this)
              : nullptr;
 }