Check path point count overflow in DrawThisAppearance

Check path point count overflow in DrawThisAppearance

BUG=387969
R=tsepez@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/a94019d

[Tom Sepez, 2014-08-15 22:58:30]

Are you sure this is the cause?  What if nCharArray is large such that malloc
(nCharArray-1)*2 fails?  It looks like we're not checking the return value for 
				path.SetPointCount((nCharArray-1)*2);

Or do we expect to throw on all out of memory errors?

Just curious, where doe nCharArray come from (maybe you can save me some
digging).

[Bo Xu, 2014-08-16 20:05:15]

On 2014/08/15 22:58:30, Tom Sepez wrote:
> Are you sure this is the cause?  What if nCharArray is large such that malloc
> (nCharArray-1)*2 fails?  It looks like we're not checking the return value for

> 				path.SetPointCount((nCharArray-1)*2);
> 
> Or do we expect to throw on all out of memory errors?
> 
> Just curious, where doe nCharArray come from (maybe you can save me some
> digging).

I agree, should check the return value of  path.setPointCount. 

nCharArray is read from the pdf file, in this case, at line 169: /MaxLen
2147483646.

That's the maximum characters in that text field box, hence determine the
spacing for each character.

I add the check for path.setPointCount in patch 3.

[Tom Sepez, 2014-08-18 18:15:47]

LGTM with nit (meaning "You can land after addressing the nit").

https://codereview.chromium.org/461343003/diff/100001/fpdfsdk/src/pdfwindow/P...
File fpdfsdk/src/pdfwindow/PWL_Edit.cpp (right):

https://codereview.chromium.org/461343003/diff/100001/fpdfsdk/src/pdfwindow/P...
fpdfsdk/src/pdfwindow/PWL_Edit.cpp:414: FX_SAFE_INT32 nCharArrayDouble =
nCharArray;
nit: Can we call this nCharArraySafe?  Double sounds too much like a
floating-point type, even though what you mean is that this value "doubles" the
other as a stand-in for it.

[Bo Xu, 2014-08-18 18:33:08]

Committed patchset #4 manually as a94019d (presubmit successful).

[Bo Xu, 2014-08-18 18:33:58]

https://codereview.chromium.org/461343003/diff/100001/fpdfsdk/src/pdfwindow/P...
File fpdfsdk/src/pdfwindow/PWL_Edit.cpp (right):

https://codereview.chromium.org/461343003/diff/100001/fpdfsdk/src/pdfwindow/P...
fpdfsdk/src/pdfwindow/PWL_Edit.cpp:414: FX_SAFE_INT32 nCharArrayDouble =
nCharArray;
On 2014/08/18 18:15:47, Tom Sepez wrote:
> nit: Can we call this nCharArraySafe?  Double sounds too much like a
> floating-point type, even though what you mean is that this value "doubles"
the
> other as a stand-in for it.

Done.