Fix buffer size boundary check offset by 1

fpdfsdk/src/fpdfview.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../include/fsdk_define.h"
 #include "../include/fpdfview.h"
 #include "../include/fsdk_rendercontext.h"
 #include "../include/fpdf_progressive.h"
@@ skipping 17 matching lines @@
                         size = m_FileAccess.m_FileLen - pos;
                 if (!m_FileAccess.m_GetBlock(m_FileAccess.m_Param, m_BufferOffset, m_Buffer, size))
                         return FALSE;
         }
         ch = m_Buffer[pos - m_BufferOffset];
         return TRUE;
 }
 
 FX_BOOL CPDF_CustomAccess::GetBlock(FX_DWORD pos, FX_LPBYTE pBuf, FX_DWORD size)
 {
-        FX_SAFE_DWORD newPos = size;
-        newPos += pos;
-        if (!newPos.IsValid() || newPos.ValueOrDie() >= m_FileAccess.m_FileLen) {
-            return FALSE;
-        }
-
-        return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, pos, pBuf, size);
+    FX_SAFE_DWORD newPos = size;
+    newPos += pos;
+    if (!newPos.IsValid() || newPos.ValueOrDie() > m_FileAccess.m_FileLen) {
+        return FALSE;
+    }
+    return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, pos, pBuf, size);
 }
 
 FX_BOOL CPDF_CustomAccess::ReadBlock(void* buffer, FX_FILESIZE offset, size_t size)
 {
-        if (offset < 0) {
-            return FALSE;
-        }
-        FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
-        newPos += offset;
-        if (!newPos.IsValid() || newPos.ValueOrDie() >= m_FileAccess.m_FileLen) {
-            return FALSE;
-        }
-
-        return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, offset,(FX_LPBYTE) buffer, size);
+    if (offset < 0) {
+        return FALSE;
+    }
+    FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
+    newPos += offset;
+    if (!newPos.IsValid() || newPos.ValueOrDie() > m_FileAccess.m_FileLen) {
+        return FALSE;
+    }
+    return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, offset,(FX_LPBYTE) buffer, size);
 }
 
 //0 bit: FPDF_POLICY_MACHINETIME_ACCESS
 static FX_DWORD foxit_sandbox_policy = 0xFFFFFFFF;
 
 void FSDK_SetSandBoxPolicy(FPDF_DWORD policy, FPDF_BOOL enable)
 {
         switch(policy)
         {
         case FPDF_POLICY_MACHINETIME_ACCESS:
@@ skipping 225 matching lines @@
 
 class CMemFile FX_FINAL: public IFX_FileRead, public CFX_Object
 {
 public:
         CMemFile(FX_BYTE* pBuf, FX_FILESIZE size):m_pBuf(pBuf),m_size(size) {}
 
         virtual void                    Release() {delete this;}
         virtual FX_FILESIZE             GetSize() {return m_size;}
         virtual FX_BOOL                 ReadBlock(void* buffer, FX_FILESIZE offset, size_t size) 
         {
-                if (offset < 0) {
-                    return FALSE;
-                }
-
-                FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
-                newPos += offset;
-                if (!newPos.IsValid() || newPos.ValueOrDie() >= (FX_DWORD)m_size) return FALSE;
+        if (offset < 0) {
+            return FALSE;
+        }
+        FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
+        newPos += offset;
+        if (!newPos.IsValid() || newPos.ValueOrDie() > (FX_DWORD)m_size) return FALSE;
                 FXSYS_memcpy(buffer, m_pBuf+offset, size);
-
                 return TRUE;
         }
 private:
         FX_BYTE* m_pBuf;
         FX_FILESIZE m_size;
 };
 DLLEXPORT FPDF_DOCUMENT STDCALL FPDF_LoadMemDocument(const void* data_buf, int size, FPDF_BYTESTRING password)
 {
         CPDF_Parser* pParser = FX_NEW CPDF_Parser;
         pParser->SetPassword(password);
@@ skipping 587 matching lines @@
 {
         if (document == NULL)
                 return NULL;
         if (name == NULL || name[0] == 0) 
                 return NULL;
 
         CPDF_Document* pDoc = (CPDF_Document*)document;
         CPDF_NameTree name_tree(pDoc, FX_BSTRC("Dests"));
         return name_tree.LookupNamedDest(pDoc, name);
 }