Fix crash in CFDE_CSSSyntaxParser when parsing empty url

xfa/fde/css/fde_csssyntax.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fde/css/fde_csssyntax.h"
 
+#include <algorithm>
+
 #include "xfa/fde/css/fde_cssdatatable.h"
 #include "xfa/fgas/crt/fgas_codepage.h"
 
 namespace {
 
 bool FDE_IsSelectorStart(FX_WCHAR wch) {
   return wch == '.' || wch == '#' || wch == '*' || (wch >= 'a' && wch <= 'z') ||
          (wch >= 'A' && wch <= 'Z');
 }
 
@@ skipping 254 matching lines @@
               break;
           }
           break;
         case FDE_CSSSYNTAXMODE_URI: {
           FDE_CSSSYNTAXMODE* pMode = m_ModeStack.GetTopElement();
           if (!pMode || *pMode != FDE_CSSSYNTAXMODE_Import)
             return m_eStatus = FDE_CSSSYNTAXSTATUS_Error;
 
           if (wch <= ' ' || wch == ';') {
             int32_t iURIStart, iURILength = m_TextData.GetLength();
-            if (iURILength > 0 &&
-                FDE_ParseCSSURI(m_TextData.GetBuffer(), iURILength, iURIStart,
-                                iURILength)) {
+            if (iURILength > 0 && FDE_ParseCSSURI(m_TextData.GetBuffer(),
+                                                  &iURIStart, &iURILength)) {
               m_TextData.Subtract(iURIStart, iURILength);
               SwitchMode(FDE_CSSSYNTAXMODE_MediaType);
-              if (IsImportEnabled()) {
+              if (IsImportEnabled())
                 return FDE_CSSSYNTAXSTATUS_URI;
-              } else {
+              else

[Tom Sepez, 2016/11/28 19:24:40]

nit: else after return not needed.

[npm, 2016/11/28 20:35:45]

Done.

                 break;
-              }
             }
           }
           AppendChar(wch);
         } break;
         case FDE_CSSSYNTAXMODE_AtRule:
           if (wch > ' ') {
             AppendChar(wch);
           } else {
             int32_t iLen = m_TextData.GetLength();
             const FX_WCHAR* psz = m_TextData.GetBuffer();
@@ skipping 158 matching lines @@
   } else {
     return true;
   }
   if (!m_pBuffer) {
     m_iBufLen = 0;
     return false;
   }
   m_iBufLen = iDesiredSize;
   return true;
 }
+
 void CFDE_CSSTextBuf::Subtract(int32_t iStart, int32_t iLength) {
-  ASSERT(iStart >= 0 && iLength > 0);
-  if (iLength > m_iDatLen - iStart) {
-    iLength = m_iDatLen - iStart;
-  }
-  if (iLength < 0) {
-    iLength = 0;
-  } else {
-    FXSYS_memmove(m_pBuffer, m_pBuffer + iStart, iLength * sizeof(FX_WCHAR));
-  }
+  ASSERT(iStart >= 0 && iLength >= 0);
+  iLength = std::max(std::min(iLength, m_iDatLen - iStart), 0);
+  FXSYS_memmove(m_pBuffer, m_pBuffer + iStart, iLength * sizeof(FX_WCHAR));
   m_iDatLen = iLength;
 }