Fix the potential integer overflow from 'offset+size' in extension.h and fpdfview.cpp

core/src/fxcrt/extension.h

Index: core/src/fxcrt/extension.h
diff --git a/core/src/fxcrt/extension.h b/core/src/fxcrt/extension.h
index b8dce7c97d9a5df829dae6fd639a090db9e40972..20fc6500dc9c0e84edf8513efb2eb994c49a0979 100644
--- a/core/src/fxcrt/extension.h
+++ b/core/src/fxcrt/extension.h
@@ -68,9 +68,13 @@ public:
     }
     virtual FX_BOOL				SetRange(FX_FILESIZE offset, FX_FILESIZE size)
     {
-        if (offset < 0 || offset + size > m_pFile->GetSize()) {
+        base::CheckedNumeric<FX_FILESIZE> pos = size;

[palmer, 2014/07/25 00:40:14]

Putting something like this:

    typedef base::CheckedNumeric<FX_FILESIZE> FileSizeT;

at the top of the file might make the code look a little cleaner. (And then you
could also use the typedef in other files that #include this one.)

[jun_fang, 2014/07/25 01:04:00]

Good idea.

+        pos += offset;
+
+        if (!pos.IsValid() || offset < 0 || size < 0 || pos.ValueOrDie() >= m_pFile->GetSize()) {
             return FALSE;
         }
+
         m_nOffset = offset, m_nSize = size;
         m_bUseRange = TRUE;
         m_pFile->SetPosition(m_nOffset);
@@ -82,13 +86,15 @@ public:
     }
     virtual FX_BOOL				ReadBlock(void* buffer, FX_FILESIZE offset, size_t size)
     {
+        base::CheckedNumeric<FX_FILESIZE> pos = offset;
+
         if (m_bUseRange) {
-            if (offset + size > (size_t)GetSize()) {
+            pos += m_nOffset;
+            if (!pos.IsValid() || pos.ValueOrDie() >= (size_t)GetSize()) {
                 return FALSE;
             }
-            offset += m_nOffset;
         }
-        return (FX_BOOL)m_pFile->ReadPos(buffer, size, offset);
+        return (FX_BOOL)m_pFile->ReadPos(buffer, size, pos.ValueOrDie());
     }
     virtual size_t				ReadBlock(void* buffer, size_t size)
     {
@@ -185,9 +191,8 @@ public:
     virtual FX_BOOL				SetRange(FX_FILESIZE offset, FX_FILESIZE size)
     {
         base::CheckedNumeric<FX_FILESIZE> range = size;
-        range += size;
- 
-        if (!range.IsValid() || offset <= 0 || size <= 0 || range.ValueOrDie() > m_nCurSize) {
+        range += offset;
+        if (!range.IsValid() || offset <= 0 || size <= 0 || range.ValueOrDie() >= m_nCurSize) {
             return FALSE;
         }
         
@@ -219,7 +224,7 @@ public:
 
         base::CheckedNumeric<size_t> newPos = size;
         newPos += offset;
-        if (!newPos.IsValid() || newPos.ValueOrDefault(0) == 0 || newPos.ValueOrDie() > m_nCurSize) {
+        if (!newPos.IsValid() || newPos.ValueOrDefault(0) == 0 || newPos.ValueOrDie() >= m_nCurSize) {
             return FALSE;
         }