Speculative fix for uninitialized value in CFX_ByteString().

fpdfsdk/include/fsdk_mgr.h

Index: fpdfsdk/include/fsdk_mgr.h
diff --git a/fpdfsdk/include/fsdk_mgr.h b/fpdfsdk/include/fsdk_mgr.h
index d7e4e3d8a8c26158e9b9ac1493537f75d0940856..cd44e9c9e3f73932fae20102799839a9d0ebc4e0 100644
--- a/fpdfsdk/include/fsdk_mgr.h
+++ b/fpdfsdk/include/fsdk_mgr.h
@@ -173,18 +173,24 @@ public:
 
 	CFX_WideString JS_fieldBrowse()
 	{
-		if(m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Field_browse)
+		if (m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Field_browse)
 		{
-			int nLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, NULL, 0);
-			if(nLen <= 0)
+			int nRequiredLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, NULL, 0);
+			if (nRequiredLen <= 0)
 				return L"";
-			char* pbuff = new char[nLen];
-			if(pbuff)
-				memset(pbuff, 0, nLen);
-			else	
+
+			char* pbuff = new char[nRequiredLen];
+			if (!pbuff)
+				return L"";
+
+			memset(pbuff, 0, nRequiredLen);
+			int nActualLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, pbuff, nRequiredLen);
+			if (nActualLen <= 0 || nActualLen > nRequiredLen)
+			{
+				delete[] pbuff;
 				return L"";
-			nLen = m_pInfo->m_pJsPlatform->Field_browse(m_pInfo->m_pJsPlatform, pbuff, nLen);
-			CFX_ByteString bsRet = CFX_ByteString(pbuff, nLen);
+			}
+			CFX_ByteString bsRet = CFX_ByteString(pbuff, nActualLen - 1);
 			CFX_WideString wsRet = CFX_WideString::FromLocal(bsRet);
 			delete[] pbuff;
 			return wsRet;
@@ -193,19 +199,25 @@ public:
 	}
 
 	CFX_WideString JS_docGetFilePath()
-	{		
-		if(m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Doc_getFilePath)
+	{
+		if (m_pInfo && m_pInfo->m_pJsPlatform && m_pInfo->m_pJsPlatform->Doc_getFilePath)
 		{
-			int nLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, NULL, 0);
-			if(nLen <= 0)
+			int nRequiredLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, NULL, 0);
+			if(nRequiredLen <= 0)

[jun_fang, 2014/07/30 00:38:01]

Need to add a blank here.

 				return L"";
-			char* pbuff = new char[nLen];
-			if(pbuff)
-				memset(pbuff, 0, nLen);
-			else
+
+			char* pbuff = new char[nRequiredLen];
+			if (!pbuff)
+				return L"";
+
+			memset(pbuff, 0, nRequiredLen);
+			int nActualLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, pbuff, nRequiredLen);
+			if (nActualLen <= 0 || nActualLen > nRequiredLen)
+			{
+				delete[] pbuff;
 				return L"";
-			nLen = m_pInfo->m_pJsPlatform->Doc_getFilePath(m_pInfo->m_pJsPlatform, pbuff, nLen);
-			CFX_ByteString bsRet = CFX_ByteString(pbuff, nLen);
+			}
+			CFX_ByteString bsRet = CFX_ByteString(pbuff, nActualLen - 1);
 			CFX_WideString wsRet = CFX_WideString::FromLocal(bsRet);
 			delete[] pbuff;
 			return wsRet;