Fix crash in CFDE_CSSSyntaxParser when parsing empty url

xfa/fde/css/fde_cssdatatable.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fde/css/fde_cssdatatable.h"
 
 #include "core/fxcrt/fx_ext.h"
 #include "xfa/fgas/crt/fgas_codepage.h"
@@ skipping 680 matching lines @@
     FDE_LPCCSSLENGTHUNITTABLE pUnit =
         FDE_GetCSSLengthUnitByName(CFX_WideStringC(pszValue, 2));
     if (pUnit)
       eUnit = (FDE_CSSPRIMITIVETYPE)pUnit->wValue;
   }
   return true;
 }
 
 bool FDE_ParseCSSString(const FX_WCHAR* pszValue,
                         int32_t iValueLen,
-                        int32_t& iOffset,
-                        int32_t& iLength) {
+                        int32_t* iOffset,
+                        int32_t* iLength) {
   ASSERT(pszValue && iValueLen > 0);
-  iOffset = 0;
-  iLength = iValueLen;
+  *iOffset = 0;
+  *iLength = iValueLen;
   if (iValueLen >= 2) {
     FX_WCHAR first = pszValue[0], last = pszValue[iValueLen - 1];
-    if ((first == '\"' && last == '\"') || (first == '\'' && last == '\'')) {
-      iOffset = 1, iLength -= 2;
-    }
+    if ((first == '\"' && last == '\"') || (first == '\'' && last == '\''))
+      *iOffset = 1, *iLength -= 2;

[Tom Sepez, 2016/11/28 19:24:40]

keep {} use ; not , and one per line.

[npm, 2016/11/28 20:35:45]

Done.

   }
   return iValueLen > 0;
 }
 
 bool FDE_ParseCSSURI(const FX_WCHAR* pszValue,
-                     int32_t iValueLen,
-                     int32_t& iOffset,
-                     int32_t& iLength) {
-  ASSERT(pszValue && iValueLen > 0);
-  if (iValueLen < 6 || pszValue[iValueLen - 1] != ')' ||
+                     int32_t* iOffset,
+                     int32_t* iLength) {
+  ASSERT(pszValue && *iLength > 0);
+  if (*iLength < 6 || pszValue[*iLength - 1] != ')' ||
       FXSYS_wcsnicmp(L"url(", pszValue, 4)) {
     return false;
   }
-  if (FDE_ParseCSSString(pszValue + 4, iValueLen - 5, iOffset, iLength)) {
-    iOffset += 4;
+  if (FDE_ParseCSSString(pszValue + 4, *iLength - 5, iOffset, iLength)) {
+    *iOffset += 4;
     return true;
   }
   return false;
 }
 
 bool FDE_ParseCSSColor(const FX_WCHAR* pszValue,
                        int32_t iValueLen,
                        FX_ARGB& dwColor) {
   ASSERT(pszValue && iValueLen > 0);
 
@@ skipping 224 matching lines @@
 
 int32_t CFDE_CSSPrimitiveValue::CountArgs() const {
   ASSERT(m_eType == FDE_CSSPRIMITIVETYPE_Function);
   return m_pFunction->CountArgs();
 }
 
 IFDE_CSSValue* CFDE_CSSPrimitiveValue::GetArgs(int32_t index) const {
   ASSERT(m_eType == FDE_CSSPRIMITIVETYPE_Function);
   return m_pFunction->GetArgs(index);
 }