Fix an out-of-boundary issue for wide string

fpdfsdk/src/javascript/app.cpp

Index: fpdfsdk/src/javascript/app.cpp
diff --git a/fpdfsdk/src/javascript/app.cpp b/fpdfsdk/src/javascript/app.cpp
index a3e61c01abe6e22c593d8ab45b780d38779cdcc1..3cf3133b42bf83d791ab255a472b679481d01f9f 100644
--- a/fpdfsdk/src/javascript/app.cpp
+++ b/fpdfsdk/src/javascript/app.cpp
@@ -1111,10 +1111,8 @@ FX_BOOL app::response(OBJ_METHOD_PARAMS)
 	}
 	else
 	{
-		nLength = nLength>2046?2046:nLength;
-    pBuff[nLength] = 0;
-    pBuff[nLength+1] = 0;
-		swResponse = CFX_WideString::FromUTF16LE((unsigned short*)pBuff, nLength);
+		nLength = nLength>2048?2048:nLength;

[palmer, 2014/07/10 19:10:55]

Why 2048?

It looks like you are removing the code that ensured the string terminated with
a 0 character/short? Why?

[Bo Xu, 2014/07/10 19:22:16]

In line 1105, the pBuff is newed to be a length of 2048, so this is to keep the
length within range. I agree this is kinda not strict. Any suggestion to remedy
this?

[palmer, 2014/07/11 00:12:29]

So, does it matter if we effectively truncate the string? If
pApp->JS_appResponse returns an nLength > than the # of bytes we allocated for
|pBuff|, it is telling us that we needed to have allocated a larger string. Some
applications would then delete[] pBuff, then re-allocate pBuff to the new
nLength, then re-invoke pApp->JS_appResponse.

But, if it is OK to set swResponse to a string that we know is not the full
result of pApp->JS_appResponse, then we should at least ensure that the string
is 0-terminated. Probably. Right?

How about this:

nLength = pApp->JS_appResponse(swQuestion, swTitle, swDefault, swLabel,
bPassWord, pBuff, nLength);

if (nLength <= 0) {
    vRet.SetNull();
    return FALSE;
} else {
    nLength = nLength > sizeof(pBuff) ? sizeof(pBuff) : nLength;
    pBuff[nLength - 1] = '\0';
    pBuff[nLength - 2] = '\0';
    vRet = swResponse = CFX_WideString::FromUTF16LE((unsigned short*)pBuff,
nLength / 2);
}

[Bo Xu, 2014/07/11 03:02:38]

The SDK only supports 2048 byte, so here is a hard cut.

The code here is not that straightforward, the WideString is zeroed in
CFX_WideString::FromUTF16LE, in CFX_WideString::GetBuffer, in static
CFX_StringDataW* FX_AllocStringW.

So we don't have to zero out here. It's not that obvious though.

+		swResponse = CFX_WideString::FromUTF16LE((unsigned short*)pBuff, nLength/2);
 		vRet = swResponse;
 	}
 	delete[] pBuff;