Speculative fix for uninitialized value in CFX_ByteString().

fpdfsdk/include/fsdk_mgr.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FPDFSDK_MGR_H
 #define _FPDFSDK_MGR_H
 
 #include "fsdk_common.h"
@@ skipping 155 matching lines @@
         void JS_appBeep(int nType)
         {
                 if(m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->app_beep)
                 {
                         m_pInfo->m_pJsPlatform->app_beep(m_pInfo->m_pJsPlatform, nType);
                 }
         }
 
         CFX_WideString JS_fieldBrowse()
         {
-                if(m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Field_browse)
+                if (m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Field_browse)
                 {
-                        int nLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, NULL, 0);
-                        if(nLen <= 0)
+                        int nRequiredLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, NULL, 0);
+                        if (nRequiredLen <= 0)
                                 return L"";
-                        char* pbuff = new char[nLen];
-                        if(pbuff)
-                                memset(pbuff, 0, nLen);
-                        else    
+
+                        char* pbuff = new char[nRequiredLen];
+                        if (!pbuff)
                                 return L"";
-                        nLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, pbuff, nLen);
-                        CFX_ByteString bsRet = CFX_ByteString(pbuff, nLen);
+
+                        memset(pbuff, 0, nRequiredLen);
+                        int nActualLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, pbuff, nRequiredLen);
+                        if (nActualLen <= 0 || nActualLen > nRequiredLen)
+                        {
+                                delete[] pbuff;
+                                return L"";
+                        }
+                        CFX_ByteString bsRet = CFX_ByteString(pbuff, nActualLen);
                         CFX_WideString wsRet = CFX_WideString::FromLocal(bsRet);
                         delete[] pbuff;
                         return wsRet;
                 }
                 return L"";
         }
 
         CFX_WideString JS_docGetFilePath()
-        {               
-                if(m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Doc_getFilePath)
+        {
+                if (m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Doc_getFilePath)
                 {
-                        int nLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, NULL, 0);
-                        if(nLen <= 0)
+                        int nRequiredLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, NULL, 0);
+                        if (nRequiredLen <= 0)
                                 return L"";
-                        char* pbuff = new char[nLen];
-                        if(pbuff)
-                                memset(pbuff, 0, nLen);
-                        else
+
+                        char* pbuff = new char[nRequiredLen];
+                        if (!pbuff)
                                 return L"";
-                        nLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, pbuff, nLen);
-                        CFX_ByteString bsRet = CFX_ByteString(pbuff, nLen);
+
+                        memset(pbuff, 0, nRequiredLen);
+                        int nActualLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, pbuff, nRequiredLen);
+                        if (nActualLen <= 0 || nActualLen > nRequiredLen)
+                        {
+                                delete[] pbuff;
+                                return L"";
+                        }
+                        CFX_ByteString bsRet = CFX_ByteString(pbuff, nActualLen);
                         CFX_WideString wsRet = CFX_WideString::FromLocal(bsRet);
                         delete[] pbuff;
                         return wsRet;
                 }
                 return L"";
         }
 
         void JS_docSubmitForm(void* formData, int length, FX_LPCWSTR URL)
         {
                 if(m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Doc_submitForm)
@@ skipping 380 matching lines @@
                 }
                 
                 if (nStartPos < m) QuickSort(nStartPos, m, bAscend, pCompare);
                 if (nStopPos > m) QuickSort(m, nStopPos, bAscend, pCompare);
         }
 };
 
 
 #endif //_FPDFSDK_MGR_H