Fix the potential integer overflow from 'offset+size' in extension.h and fpdfview.cpp

fpdfsdk/src/fpdfview.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../include/fsdk_define.h"
 #include "../include/fpdfview.h"
 #include "../include/fsdk_rendercontext.h"
 #include "../include/fpdf_progressive.h"
 #include "../include/fpdf_ext.h"
-
+#include "../../third_party/numerics/safe_conversions_impl.h"
 
 CPDF_CustomAccess::CPDF_CustomAccess(FPDF_FILEACCESS* pFileAccess)
 {
         m_FileAccess = *pFileAccess;
         m_BufferOffset = (FX_DWORD)-1;
 }
 
 FX_BOOL CPDF_CustomAccess::GetByte(FX_DWORD pos, FX_BYTE& ch)
 {
         if (pos >= m_FileAccess.m_FileLen) return FALSE;
         if (m_BufferOffset == (FX_DWORD)-1 || pos < m_BufferOffset || pos >= m_BufferOffset + 512) {
                 // Need to read from file access
                 m_BufferOffset = pos;
                 int size = 512;
                 if (pos + 512 > m_FileAccess.m_FileLen)
                         size = m_FileAccess.m_FileLen - pos;
                 if (!m_FileAccess.m_GetBlock(m_FileAccess.m_Param, m_BufferOffset, m_Buffer, size))
                         return FALSE;
         }
         ch = m_Buffer[pos - m_BufferOffset];
         return TRUE;
 }
 
 FX_BOOL CPDF_CustomAccess::GetBlock(FX_DWORD pos, FX_LPBYTE pBuf, FX_DWORD size)
 {
-        if (pos + size > m_FileAccess.m_FileLen) return FALSE;
+        FX_SAFE_DWORD newPos = size;
+        newPos += pos;
+        if (!newPos.IsValid() || newPos.ValueOrDie() >= m_FileAccess.m_FileLen) return FALSE;

[Tom Sepez, 2014/07/30 18:50:25]

nit: newline and indent rather than single-line if?

+
         return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, pos, pBuf, size);
 }
 
 FX_BOOL CPDF_CustomAccess::ReadBlock(void* buffer, FX_FILESIZE offset, size_t size)
 {
-        //      m_FileAccess = *pFileAccess;
-        //      m_BufferOffset = (FX_DWORD)-1;
-        if (offset + size > m_FileAccess.m_FileLen) return FALSE;
+        if (offset < 0) return FALSE;
+        FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
+        newPos += offset;
+        if (!newPos.IsValid() || newPos.ValueOrDie() >= m_FileAccess.m_FileLen) return FALSE;

[Tom Sepez, 2014/07/30 18:50:24]

nit:ditto

+
         return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, offset,(FX_LPBYTE) buffer, size);
-
-        //      return FALSE;
 }
 
 //0 bit: FPDF_POLICY_MACHINETIME_ACCESS
 static FX_DWORD foxit_sandbox_policy = 0xFFFFFFFF;
 
 void FSDK_SetSandBoxPolicy(FPDF_DWORD policy, FPDF_BOOL enable)
 {
         switch(policy)
         {
         case FPDF_POLICY_MACHINETIME_ACCESS:
@@ skipping 225 matching lines @@
 
 class CMemFile FX_FINAL: public IFX_FileRead, public CFX_Object
 {
 public:
         CMemFile(FX_BYTE* pBuf, FX_FILESIZE size):m_pBuf(pBuf),m_size(size) {}
 
         virtual void                    Release() {delete this;}
         virtual FX_FILESIZE             GetSize() {return m_size;}
         virtual FX_BOOL                 ReadBlock(void* buffer, FX_FILESIZE offset, size_t size) 
         {
-                if(offset+size > (FX_DWORD)m_size) return FALSE;
+                if (offset < 0) return FALSE;
+

[Tom Sepez, 2014/07/30 18:50:25]

nit: ditto.

+                FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
+                newPos += offset;
+                if (!newPos.IsValid() || newPos.ValueOrDie() >= (FX_DWORD)m_size) return FALSE;
                 FXSYS_memcpy(buffer, m_pBuf+offset, size);
+
                 return TRUE;
         }
 private:
         FX_BYTE* m_pBuf;
         FX_FILESIZE m_size;
 };
 DLLEXPORT FPDF_DOCUMENT STDCALL FPDF_LoadMemDocument(const void* data_buf, int size, FPDF_BYTESTRING password)
 {
         CPDF_Parser* pParser = FX_NEW CPDF_Parser;
         pParser->SetPassword(password);
@@ skipping 587 matching lines @@
 {
         if (document == NULL)
                 return NULL;
         if (name == NULL || name[0] == 0) 
                 return NULL;
 
         CPDF_Document* pDoc = (CPDF_Document*)document;
         CPDF_NameTree name_tree(pDoc, FX_BSTRC("Dests"));
         return name_tree.LookupNamedDest(pDoc, name);
 }