Fix the potential integer overflow from "offset + size"

core/src/fxcrt/extension.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FXCRT_EXTENSION_IMP_
 #define _FXCRT_EXTENSION_IMP_
+
+const size_t MAX_SIZE_T = size_t(-1);
+
 class IFXCRT_FileAccess
 {
 public:
     virtual ~IFXCRT_FileAccess() {}
     virtual FX_BOOL             Open(FX_BSTR fileName, FX_DWORD dwMode) = 0;
     virtual FX_BOOL             Open(FX_WSTR fileName, FX_DWORD dwMode) = 0;
     virtual void                Close() = 0;
     virtual void                Release(IFX_Allocator* pAllocator = NULL) = 0;
     virtual FX_FILESIZE GetSize() const = 0;
     virtual FX_FILESIZE GetPosition() const = 0;
@@ skipping 168 matching lines @@
     virtual FX_FILESIZE                 GetPosition()
     {
         FX_FILESIZE pos = (FX_FILESIZE)m_nCurPos;
         if (m_bUseRange) {
             pos -= (FX_FILESIZE)m_nOffset;
         }
         return pos;
     }
     virtual FX_BOOL                             SetRange(FX_FILESIZE offset, FX_FILESIZE size)
     {
-        if (offset < 0 || (size_t)(offset + size) > m_nCurSize) {
+        if (offset < 0 || offset + size > m_nCurSize) {
             return FALSE;
         }
         m_nOffset = (size_t)offset, m_nSize = (size_t)size;
         m_bUseRange = TRUE;
         m_nCurPos = m_nOffset;
         return TRUE;
     }
     virtual void                                ClearRange()
     {
         m_bUseRange = FALSE;
     }
     virtual FX_BOOL                             ReadBlock(void* buffer, FX_FILESIZE offset, size_t size)
     {
         if (!buffer || !size) {
             return FALSE;
         }
         if (m_bUseRange) {
             offset += (FX_FILESIZE)m_nOffset;
         }
+
+        if(offset > MAX_SIZE_T - size)
+            return FALSE;
+
         if ((size_t)offset + size > m_nCurSize) {
             return FALSE;
         }
         m_nCurPos = (size_t)offset + size;
         if (m_dwFlags & FX_MEMSTREAM_Consecutive) {
             FXSYS_memcpy32(buffer, (FX_LPBYTE)m_Blocks[0] + (size_t)offset, size);
             return TRUE;
         }
         size_t nStartBlock = (size_t)offset / m_nGrowSize;
         offset -= (FX_FILESIZE)(nStartBlock * m_nGrowSize);
@@ skipping 29 matching lines @@
     }
     virtual     FX_BOOL                         WriteBlock(const void* buffer, FX_FILESIZE offset, size_t size)
     {
         if (!buffer || !size) {
             return FALSE;
         }
         if (m_bUseRange) {
             offset += (FX_FILESIZE)m_nOffset;
         }
         if (m_dwFlags & FX_MEMSTREAM_Consecutive) {
+            if(offset > MAX_SIZE_T - size)
+                return FALSE;
+
             m_nCurPos = (size_t)offset + size;
             if (m_nCurPos > m_nTotalSize) {
                 IFX_Allocator* pAllocator = m_Blocks.m_pAllocator;
                 m_nTotalSize = (m_nCurPos + m_nGrowSize - 1) / m_nGrowSize * m_nGrowSize;
                 if (m_Blocks.GetSize() < 1) {
                     void* block = FX_Allocator_Alloc(pAllocator, FX_BYTE, m_nTotalSize);
                     m_Blocks.Add(block);
                 } else {
                     m_Blocks[0] = FX_Allocator_Realloc(pAllocator, FX_BYTE, m_Blocks[0], m_nTotalSize);
                 }
                 if (!m_Blocks[0]) {
                     m_Blocks.RemoveAll();
                     return FALSE;
                 }
             }
             FXSYS_memcpy32((FX_LPBYTE)m_Blocks[0] + (size_t)offset, buffer, size);
             if (m_nCurSize < m_nCurPos) {
                 m_nCurSize = m_nCurPos;
             }
             return TRUE;
         }
+
+        if(offset > MAX_SIZE_T - size)
+            return FALSE;
+
         if (!ExpandBlocks((size_t)offset + size)) {
             return FALSE;
         }
         m_nCurPos = (size_t)offset + size;
         size_t nStartBlock = (size_t)offset / m_nGrowSize;
         offset -= (FX_FILESIZE)(nStartBlock * m_nGrowSize);
         while (size) {
             size_t nWrite = m_nGrowSize - (size_t)offset;
             if (nWrite > size) {
                 nWrite = size;
@@ skipping 107 matching lines @@
     FX_DWORD mt[MT_N];
 } FX_MTRANDOMCONTEXT, * FX_LPMTRANDOMCONTEXT;
 typedef FX_MTRANDOMCONTEXT const * FX_LPCMTRANDOMCONTEXT;
 #if _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
 FX_BOOL FX_GenerateCryptoRandom(FX_LPDWORD pBuffer, FX_INT32 iCount);
 #endif
 #ifdef __cplusplus
 }
 #endif
 #endif