Fix an out-of-boundary issue for wide string

fpdfsdk/src/javascript/app.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/javascript/JavaScript.h"
 #include "../../include/javascript/IJavaScript.h"
 #include "../../include/javascript/JS_Define.h"
 #include "../../include/javascript/JS_Object.h"
@@ skipping 1093 matching lines @@
         int nLength = 2048;
         char* pBuff = new char[nLength];
         nLength = pApp->JS_appResponse(swQuestion, swTitle, swDefault, swLabel, bPassWord, pBuff, nLength);
         if(nLength<=0)
         {
                 vRet.SetNull();
                 return FALSE;
         }
         else
         {
-                nLength = nLength>2046?2046:nLength;
-    pBuff[nLength] = 0;
-    pBuff[nLength+1] = 0;
-                swResponse = CFX_WideString::FromUTF16LE((unsigned short*)pBuff, nLength);
+                nLength = nLength>2048?2048:nLength;

[palmer, 2014/07/10 19:10:55]

Why 2048?

It looks like you are removing the code that ensured the string terminated with
a 0 character/short? Why?

[Bo Xu, 2014/07/10 19:22:16]

In line 1105, the pBuff is newed to be a length of 2048, so this is to keep the
length within range. I agree this is kinda not strict. Any suggestion to remedy
this?

[palmer, 2014/07/11 00:12:29]

So, does it matter if we effectively truncate the string? If
pApp->JS_appResponse returns an nLength > than the # of bytes we allocated for
|pBuff|, it is telling us that we needed to have allocated a larger string. Some
applications would then delete[] pBuff, then re-allocate pBuff to the new
nLength, then re-invoke pApp->JS_appResponse.

But, if it is OK to set swResponse to a string that we know is not the full
result of pApp->JS_appResponse, then we should at least ensure that the string
is 0-terminated. Probably. Right?

How about this:

nLength = pApp->JS_appResponse(swQuestion, swTitle, swDefault, swLabel,
bPassWord, pBuff, nLength);

if (nLength <= 0) {
    vRet.SetNull();
    return FALSE;
} else {
    nLength = nLength > sizeof(pBuff) ? sizeof(pBuff) : nLength;
    pBuff[nLength - 1] = '\0';
    pBuff[nLength - 2] = '\0';
    vRet = swResponse = CFX_WideString::FromUTF16LE((unsigned short*)pBuff,
nLength / 2);
}

[Bo Xu, 2014/07/11 03:02:38]

The SDK only supports 2048 byte, so here is a hard cut.

The code here is not that straightforward, the WideString is zeroed in
CFX_WideString::FromUTF16LE, in CFX_WideString::GetBuffer, in static
CFX_StringDataW* FX_AllocStringW.

So we don't have to zero out here. It's not that obvious though.

+                swResponse = CFX_WideString::FromUTF16LE((unsigned short*)pBuff, nLength/2);
                 vRet = swResponse;
         }
         delete[] pBuff;
 
         return TRUE;
 }
 
 FX_BOOL app::media(OBJ_PROP_PARAMS)
 {
         return FALSE;
 }
 
 FX_BOOL app::execDialog(OBJ_METHOD_PARAMS)
 {
         return TRUE;
 }