Fix the issue 'SEGV on unknown address in CPDF_DataAvail::GetObjectSize'

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 2711 matching lines @@
     m_bufferSize = 0;
     m_PagesObjNum = 0;
     m_dwCurrentXRefSteam = 0;
     m_dwAcroFormObjNum = 0;
     m_dwInfoObjNum = 0;
     m_pDocument = 0;
     m_dwEncryptObjNum = 0;
     m_dwPrevXRefOffset = 0;
     m_dwLastXRefOffset = 0;
     m_bDocAvail = FALSE;
-    m_bMainXRefLoad = FALSE;
+    m_bMainXRefLoadTried = FALSE;
     m_bDocAvail = FALSE;
     m_bLinearized = FALSE;
     m_bPagesLoad = FALSE;
     m_bPagesTreeLoad = FALSE;
     m_bMainXRefLoadedOK = FALSE;
     m_bAnnotsLoad = FALSE;
     m_bHaveAcroForm = FALSE;
     m_bAcroFormLoad = FALSE;
     m_bPageLoadedOK = FALSE;
     m_bNeedDownLoadResource = FALSE;
@@ skipping 1357 matching lines @@
         return TRUE;
     }
     m_pDocument->LoadPages();
     return FALSE;
 }
 FX_BOOL CPDF_DataAvail::CheckLinearizedData(IFX_DownloadHints* pHints)
 {
     if (m_bLinearedDataOK) {
         return TRUE;
     }
-    if (!m_pFileAvail->IsDataAvail(m_dwLastXRefOffset, (FX_DWORD)(m_dwFileLen - m_dwLastXRefOffset))) {
-        pHints->AddSegment(m_dwLastXRefOffset, (FX_DWORD)(m_dwFileLen - m_dwLastXRefOffset));
-        return FALSE;
+
+    if (!m_bMainXRefLoadTried) {
+        FX_SAFE_DWORD data_size = m_dwFileLen;
+        data_size -= m_dwLastXRefOffset;
+        if (!data_size.IsValid()) {
+            return FALSE;
+        }
+        if (!m_pFileAvail->IsDataAvail(m_dwLastXRefOffset, data_size.ValueOrDie())) {
+            pHints->AddSegment(m_dwLastXRefOffset, data_size.ValueOrDie());
+            return FALSE;
+        }
+        FX_DWORD dwRet = ((CPDF_Parser *)m_pDocument->GetParser())->LoadLinearizedMainXRefTable();
+        m_bMainXRefLoadTried = TRUE;
+        if (dwRet != PDFPARSE_ERROR_SUCCESS) {
+            return FALSE;
+        }
+        if (!PreparePageItem()) {
+            return FALSE;
+        }
+        m_bMainXRefLoadedOK = TRUE;
+        m_bLinearedDataOK   = TRUE;
     }
-    FX_DWORD dwRet = 0;
-    if (!m_bMainXRefLoad) {
-        dwRet = ((CPDF_Parser *)m_pDocument->GetParser())->LoadLinearizedMainXRefTable();
-        if (dwRet == PDFPARSE_ERROR_SUCCESS) {
-            if (!PreparePageItem()) {
-                return FALSE;
-            }
-            m_bMainXRefLoadedOK = TRUE;
-        }
-        m_bMainXRefLoad = TRUE;
-    }
-    m_bLinearedDataOK = TRUE;
-    return TRUE;
+
+    return m_bLinearedDataOK;
 }
 FX_BOOL CPDF_DataAvail::CheckPageAnnots(FX_INT32 iPage, IFX_DownloadHints* pHints)
 {
     if (!m_objs_array.GetSize()) {
         m_objs_array.RemoveAll();
         m_objnum_array.RemoveAll();
         CPDF_Dictionary *pPageDict = m_pDocument->GetPage(iPage);
         if (!pPageDict) {
             return TRUE;
         }
@@ skipping 207 matching lines @@
     }
     if (!m_bLinearizedFormParamLoad) {
         CPDF_Dictionary *pRoot = m_pDocument->GetRoot();
         if (!pRoot) {
             return PDFFORM_AVAIL;
         }
         CPDF_Object *pAcroForm = pRoot->GetElement(FX_BSTRC("AcroForm"));
         if (!pAcroForm) {
             return PDFFORM_NOTEXIST;
         }
-        if (!m_bMainXRefLoad && !CheckLinearizedData(pHints)) {
+        if (!CheckLinearizedData(pHints)) {
             return PDFFORM_NOTAVAIL;
         }
         if (!m_objs_array.GetSize()) {
             m_objs_array.Add(pAcroForm->GetDict());
         }
         m_bLinearizedFormParamLoad = TRUE;
     }
     CFX_PtrArray new_objs_array;
     FX_BOOL bRet = IsObjectsAvail(m_objs_array, FALSE, pHints, new_objs_array);
     m_objs_array.RemoveAll();
@@ skipping 40 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }