Fix the issue 'SEGV on unknown address in CPDF_DataAvail::GetObjectSize'

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 4089 matching lines @@
         return TRUE;
     }
     m_pDocument->LoadPages();
     return FALSE;
 }
 FX_BOOL CPDF_DataAvail::CheckLinearizedData(IFX_DownloadHints* pHints)
 {
     if (m_bLinearedDataOK) {
         return TRUE;
     }
     if (!m_pFileAvail->IsDataAvail(m_dwLastXRefOffset, (FX_DWORD)(m_dwFileLen - m_dwLastXRefOffset))) {

[Tom Sepez, 2014/08/09 17:55:36]

Is this going to change on subsequent calls?  In other words, if we try this
once and it fails, is there ever a possibility it might succeed? It doesn't seem
that way (unless the file is being created underneath us) yet we end up
repeating it. Should this move under the if (!m_bmainXrefLoad) branch below?

[jun_fang, 2014/08/18 06:58:00]

If IsDataAvail returns FALSE, that means that data are not available completely
for parsing them into XRefTable which is very important data structure in PDF.
So it just needs to return FALSE rather than loading XRefTable because data for
parsing are not available.

         pHints->AddSegment(m_dwLastXRefOffset, (FX_DWORD)(m_dwFileLen - m_dwLastXRefOffset));
         return FALSE;
     }
     FX_DWORD dwRet = 0;
     if (!m_bMainXRefLoad) {

[Tom Sepez, 2014/08/09 17:55:36]

does m_bMainXRefLoad mean "main xref load succeeded" or "main xref load was
tried once already"?  I think its the later, and if so, the name should be
m_bMainXrefLoadTried.

[jun_fang, 2014/08/18 06:58:00]

if |m_bMainXRefLoad| is true, it means that xref is loaded successfully not the
second meaning you mentioned.

[palmer, 2014/08/19 20:26:41]

In that case, I would call it |m_bMainXRefLoadSucceeded|.

         dwRet = ((CPDF_Parser *)m_pDocument->GetParser())->LoadLinearizedMainXRefTable();
-        if (dwRet == PDFPARSE_ERROR_SUCCESS) {
-            if (!PreparePageItem()) {
-                return FALSE;
-            }
-            m_bMainXRefLoadedOK = TRUE;
+        if (dwRet != PDFPARSE_ERROR_SUCCESS) {
+            return FALSE;
         }
+        if (!PreparePageItem()) {
+            return FALSE;
+        }
+        m_bMainXRefLoadedOK = TRUE;

[Tom Sepez, 2014/08/09 17:55:36]

What's the difference between m_bMainXrefLoadedOK and m_bLinearizedDataOK?  Is
it ever the case that one is true without the other?

[jun_fang, 2014/08/18 06:58:00]

They are different. |m_bMainXrefLoadedOK is true| means that XRef table is
loaded successfully. |m_bLinearizedDataOK is true| means that data are
downloaded and available for being parsed.

[palmer, 2014/08/19 20:26:41]

Wait, then what does |m_bMainXRefLoad| mean that is distinct from
|m_bMainXRefLoadedOK|?

         m_bMainXRefLoad = TRUE;
     }
     m_bLinearedDataOK = TRUE;
     return TRUE;
 }
 FX_BOOL CPDF_DataAvail::CheckPageAnnots(FX_INT32 iPage, IFX_DownloadHints* pHints)
 {
     if (!m_objs_array.GetSize()) {
         m_objs_array.RemoveAll();
         m_objnum_array.RemoveAll();
@@ skipping 272 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }