Fix for UMR in CXML_Parser::GetCharRef.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../fpdf_page/pageint.h"
@@ skipping 2393 matching lines @@
     return NULL;
 }
 CPDF_Stream* CPDF_SyntaxParser::ReadStream(CPDF_Dictionary* pDict, PARSE_CONTEXT* pContext,
         FX_DWORD objnum, FX_DWORD gennum)
 {
     CPDF_Object* pLenObj = pDict->GetElement(FX_BSTRC("Length"));
     FX_DWORD len = 0;
     if (pLenObj && ((pLenObj->GetType() != PDFOBJ_REFERENCE) ||
                     ((((CPDF_Reference*)pLenObj)->GetObjList() != NULL) &&
                      ((CPDF_Reference*)pLenObj)->GetRefObjNum() != objnum))) {
-        FX_FILESIZE pos = m_Pos;
         if (pLenObj) {
             len = pLenObj->GetInteger();
         }
-        m_Pos = pos;
         if (len > 0x40000000) {
             return NULL;
         }
     }
     ToNextLine();
     FX_FILESIZE StreamStartPos = m_Pos;
     if (pContext) {
         pContext->m_DataStart = m_Pos;
     }
     m_Pos += len;
+    if (m_Pos >= m_FileLen) {

[jun_fang, 2014/07/08 17:37:11]

Type
m_Pos:     FX_FILESIZE -> FX_INT32->int
m_FileLen: FX_FILESIZE -> FX_INT32->int
at line 2410: FX_DWORD len = 0; FX_DWORD->unsigned int
at line 2426: m_Pos += len;

len's scope is larger than m_Pos and m_FileLen.

Suggestion:
change FX_DWORD to FX_FILESIZE at line 2410. 

[Robert Sesek, 2014/07/08 18:35:57]

Done, and Chris Palmer also suggested using CheckedNumeric because for a
sufficiently large value of |len|, it could still overflow.

+        return NULL;
+    }
     CPDF_CryptoHandler* pCryptoHandler = objnum == (FX_DWORD)m_MetadataObjnum ? NULL : m_pCryptoHandler;
     if (pCryptoHandler == NULL) {
         FX_FILESIZE SavedPos = m_Pos;
         GetNextWord();
         if (m_WordSize < 9 || FXSYS_memcmp32(m_WordBuffer, "endstream", 9)) {
             m_Pos = StreamStartPos;
             FX_FILESIZE offset = FindTag(FX_BSTRC("endstream"), 0);
             if (offset >= 0) {
                 FX_FILESIZE curPos = m_Pos;
                 m_Pos = StreamStartPos;
@@ skipping 1941 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }