Perform better input checks in early steps of parser.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 140 matching lines @@
     m_bOwnFileRead = bOwnFileRead;
     FX_INT32 offset = GetHeaderOffset(pFileAccess);
     if (offset == -1) {
         if (bOwnFileRead && pFileAccess) {
             pFileAccess->Release();
         }
         return PDFPARSE_ERROR_FORMAT;
     }
     m_Syntax.InitParser(pFileAccess, offset);
     FX_BYTE ch;
-    m_Syntax.GetCharAt(5, ch);
+    if (!m_Syntax.GetCharAt(5, ch) || ch < '0' || ch > '9') {

[jun_fang, 2014/08/25 19:44:04]

This is used to parse file version which is not important information. Even it's
invalid, we shouldn't need to block the further parsing. So it's better to keep
it no change. 

[Tom Sepez, 2014/08/25 20:05:32]

Ok.  I'll keep going but ingore out-of-range values, then.

+        return PDFPARSE_ERROR_FORMAT;
+    }
     m_FileVersion = (ch - '0') * 10;
-    m_Syntax.GetCharAt(7, ch);
+    if (!m_Syntax.GetCharAt(7, ch) || ch < '0' || ch > '9') {
+        return PDFPARSE_ERROR_FORMAT;
+    }
     m_FileVersion += ch - '0';
+    if (m_Syntax.m_FileLen <  m_Syntax.m_HeaderOffset + 9) {
+        return PDFPARSE_ERROR_FORMAT;
+    }
     m_Syntax.RestorePos(m_Syntax.m_FileLen - m_Syntax.m_HeaderOffset - 9);
     if (!bReParse) {
         m_pDocument = FX_NEW CPDF_Document(this);
     }
     FX_BOOL bXRefRebuilt = FALSE;
     if (m_Syntax.SearchWord(FX_BSTRC("startxref"), TRUE, FALSE, 4096)) {
         FX_FILESIZE startxref_offset = m_Syntax.SavePos();
         FX_LPVOID pResult = FXSYS_bsearch(&startxref_offset, m_SortedOffset.GetData(), m_SortedOffset.GetSize(), sizeof(FX_FILESIZE), _CompareFileSize);
         if (pResult == NULL) {
             m_SortedOffset.Add(startxref_offset);
@@ skipping 4230 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }