Fix bounds checking in CJS_PublicMethods::MakeRegularDate().

fpdfsdk/src/javascript/PublicMethods.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/javascript/JavaScript.h"
 #include "../../include/javascript/IJavaScript.h"
 #include "../../include/javascript/JS_Define.h"
 #include "../../include/javascript/JS_Object.h"
@@ skipping 606 matching lines @@
         int nDay = JS_GetDayFromTime(dt);
         int nHour = JS_GetHourFromTime(dt);
         int nMin = JS_GetMinFromTime(dt);
         int nSec = JS_GetSecFromTime(dt);
 
         int nYearSub = 99; //nYear - 2000;
 
         FX_BOOL bPm = FALSE;
         FX_BOOL bExit = FALSE;
         bWrongFormat = FALSE;
-        
+
         int i=0;
         int j=0;
 
         while (i < format.GetLength())
         {
                 if (bExit) break;
 
-                FX_WCHAR c = format.GetAt(i);           
+                FX_WCHAR c = format.GetAt(i);
                 switch (c)
                 {
                         case ':':
                         case '.':
                         case '-':
                         case '\\':
                         case '/':
                                 i++;
                                 j++;
                                 break;
-                                
+
                         case 'y':
                         case 'm':
                         case 'd':
                         case 'H':
                         case 'h':
                         case 'M':
                         case 's':
                         case 't':
                                 {
                                         int oldj = j;
-                                        int nSkip = 0;
+                                        int nSkip = 0;
+                                        int remaining = format.GetLength() - i - 1;

[jun_fang, 2014/07/18 17:30:59]

should alignment with the previous line? I saw it didn't align with the previous
one when I checked the raw file.

[Tom Sepez, 2014/07/18 18:00:04]

I "untabified" the entire function. That should make the aligmnent consistent
regardless of tab settings.

 
-                                        if (format.GetAt(i+1) != c)
+                                        if (remaining < 1 || format.GetAt(i+1) != c)

[jun_fang, 2014/07/18 17:30:59]

remaining == 1 rather than remaining < 1

for example:
int remaining = format.GetLength() - i - 1;
let's assume 'format.GetLength() = 1, i =0'
the remaining is 0 can meet the if condition, but format.GetAt(1) is incorrect
access.

[Tom Sepez, 2014/07/18 18:00:04]

No, its an "or", not an "and", so when remaining is 0, 0 is < 1 and we
short-circuit the evaluation of GetAt(i+1) and go directly to the switch, which
doesn't depend upon the char at i+i.

                                         {
                                                 switch (c)
                                                 {
                                                         case 'y':
                                                                 i++;
                                                                 j++;
                                                                 break;
                                                         case 'm':
                                                                 nMonth = ParseStringInteger(value, j, nSkip, 2);
                                                                 i++;
@@ skipping 18 matching lines @@
                                                                 nMin = ParseStringInteger(value, j, nSkip, 2);
                                                                 i++;
                                                                 j += nSkip;
                                                                 break;
                                                         case 's':
                                                                 nSec = ParseStringInteger(value, j, nSkip, 2);
                                                                 i++;
                                                                 j += nSkip;
                                                                 break;
                                                         case 't':
-                                                                bPm = value.GetAt(i) == 'p';
+                                                                bPm = (j < value.GetLength() && value.GetAt(j) == 'p');
                                                                 i++;
                                                                 j++;
                                                                 break;
-                                                }                                       
+                                                }
                                         }
-                                        else if (format.GetAt(i+1) == c && format.GetAt(i+2) != c)
+                                        else if (remaining < 2 || format.GetAt(i+2) != c)

[jun_fang, 2014/07/18 17:30:59]

remaining == 2

                                         {
                                                 switch (c)
                                                 {
                                                         case 'y':
                                                                 nYear = ParseStringInteger(value, j, nSkip, 4);
                                                                 i += 2;
                                                                 j += nSkip;
                                                                 break;
                                                         case 'm':
                                                                 nMonth = ParseStringInteger(value, j, nSkip, 2);
@@ skipping 19 matching lines @@
                                                                 nMin = ParseStringInteger(value, j, nSkip, 2);
                                                                 i += 2;
                                                                 j += nSkip;
                                                                 break;
                                                         case 's':
                                                                 nSec = ParseStringInteger(value, j, nSkip, 2);
                                                                 i += 2;
                                                                 j += nSkip;
                                                                 break;
                                                         case 't':
-                                                                bPm = (value.GetAt(j) == 'p' && value.GetAt(j+1) == 'm');
+                                                                bPm = (j + 1 < value.GetLength() && value.GetAt(j) == 'p' && value.GetAt(j+1) == 'm');
                                                                 i += 2;
                                                                 j += 2;
                                                                 break;
                                                 }
                                         }
-                                        else if (format.GetAt(i+1) == c && format.GetAt(i+2) == c && format.GetAt(i+3) != c)
+                                        else if (remaining < 3 || format.GetAt(i+3) != c)

[jun_fang, 2014/07/18 17:30:59]

remaining == 3

                                         {
                                                 switch (c)
                                                 {
                                                         case 'm':
                                                                 {
                                                                         CFX_WideString sMonth = ParseStringString(value, j, nSkip);
                                                                         FX_BOOL bFind = FALSE;
                                                                         for (int m = 0; m < 12; m++)
                                                                         {
                                                                                 if (sMonth.CompareNoCase(months[m]) == 0)
                                                                                 {
                                                                                         nMonth = m + 1;
                                                                                         i+=3;
                                                                                         j+=nSkip;
                                                                                         bFind = TRUE;
                                                                                         break;
                                                                                 }
                                                                         }
-                                                                        
+
                                                                         if (!bFind)
                                                                         {
                                                                                 nMonth = ParseStringInteger(value, j, nSkip, 3);
                                                                                 i+=3;
                                                                                 j += nSkip;
                                                                         }
                                                                 }
                                                                 break;
                                                         case 'y':
                                                                 break;
                                                         default:
                                                                 i+=3;
                                                                 j+=3;
                                                                 break;
                                                 }
                                         }
-                                        else if (format.GetAt(i+1) == c && format.GetAt(i+2) == c && format.GetAt(i+3) == c && format.GetAt(i+4) != c)
+                                        else if (remaining < 4 || format.GetAt(i+4) != c)

[jun_fang, 2014/07/18 17:30:59]

remaining == 4

                                         {
                                                 switch (c)
                                                 {
 
 
                                                         case 'y':
                                                                 nYear = ParseStringInteger(value, j, nSkip, 4);
                                                                 j += nSkip;
                                                                 i += 4;
                                                                 break;
@@ skipping 11 matching lines @@
 
                                                                                 if (sFullMonths.Find(sMonth, 0) != -1)
                                                                                 {
                                                                                         nMonth = m + 1;
                                                                                         i += 4;
                                                                                         j += nSkip;
                                                                                         bFind = TRUE;
                                                                                         break;
                                                                                 }
                                                                         }
-                                                                        
+
                                                                         if (!bFind)
                                                                         {
                                                                                 nMonth = ParseStringInteger(value, j, nSkip, 4);
                                                                                 i+=4;
                                                                                 j += nSkip;
                                                                         }
                                                                 }
                                                                 break;
                                                         default:
                                                                 i += 4;
                                                                 j += 4;
                                                                 break;
-                                                }                                       
+                                                }
                                         }
                                         else
                                         {
-                                                if (format.GetAt(i) != value.GetAt(j))
+                                                if (j >= value.GetLength() || format.GetAt(i) != value.GetAt(j))
                                                 {
                                                         bWrongFormat = TRUE;
                                                         bExit = TRUE;
                                                 }
                                                 i++;
                                                 j++;
                                         }
-                                        
+
                                         if (oldj == j)
                                         {
                                                 bWrongFormat = TRUE;
                                                 bExit = TRUE;
                                         }
                                 }
 
-                                break;                  
+                                break;
                         default:
                                 if (value.GetLength() <= j)
                                 {
                                         bExit = TRUE;
                                 }
                                 else if (format.GetAt(i) != value.GetAt(j))
                                 {
                                         bWrongFormat = TRUE;
                                         bExit = TRUE;
                                 }
 
                                 i++;
                                 j++;
                                 break;
-                }               
+                }
         }
 
         if (bPm) nHour += 12;
 
         if (nYear >= 0 && nYear <= nYearSub)
                 nYear += 2000;
 
         if (nMonth < 1 || nMonth > 12)
                 bWrongFormat = TRUE;
 
@@ skipping 1449 matching lines @@
                 nums.SetElement(nIndex,CJS_Value(isolate,(FX_LPCWSTR)sPart));   
         }
 
         if (nums.GetLength() > 0)
                 vRet = nums;
         else
                 vRet.SetNull();
 
         return TRUE;
 }