Perform better input checks in early steps of parser.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 33 matching lines @@
 CPDF_Parser::CPDF_Parser()
 {
     m_pDocument = NULL;
     m_pTrailer = NULL;
     m_pEncryptDict = NULL;
     m_pSecurityHandler = NULL;
     m_pLinearized = NULL;
     m_dwFirstPageNo = 0;
     m_dwXrefStartObjNum = 0;
     m_bOwnFileRead = TRUE;
+    m_FileVersion = 0;
     m_bForceUseSecurityHandler = FALSE;
 }
 CPDF_Parser::~CPDF_Parser()
 {
     CloseParser(FALSE);
 }
 FX_DWORD CPDF_Parser::GetLastObjNum()
 {
     FX_DWORD dwSize = m_CrossRef.GetSize();
     return dwSize ? dwSize - 1 : 0;
@@ skipping 87 matching lines @@
     m_bOwnFileRead = bOwnFileRead;
     FX_INT32 offset = GetHeaderOffset(pFileAccess);
     if (offset == -1) {
         if (bOwnFileRead && pFileAccess) {
             pFileAccess->Release();
         }
         return PDFPARSE_ERROR_FORMAT;
     }
     m_Syntax.InitParser(pFileAccess, offset);
     FX_BYTE ch;
-    m_Syntax.GetCharAt(5, ch);
-    m_FileVersion = (ch - '0') * 10;
-    m_Syntax.GetCharAt(7, ch);
-    m_FileVersion += ch - '0';
+    if (!m_Syntax.GetCharAt(5, ch)) {
+        return PDFPARSE_ERROR_FORMAT;
+    }
+    if (ch >= '0' && ch <= '9') {
+        m_FileVersion = (ch - '0') * 10;
+    }
+    if (!m_Syntax.GetCharAt(7, ch)) {
+        return PDFPARSE_ERROR_FORMAT;
+    }
+    if (ch >= '0' && ch <= '9') {
+        m_FileVersion += ch - '0';
+    }
+    if (m_Syntax.m_FileLen <  m_Syntax.m_HeaderOffset + 9) {
+        return PDFPARSE_ERROR_FORMAT;
+    }
     m_Syntax.RestorePos(m_Syntax.m_FileLen - m_Syntax.m_HeaderOffset - 9);
     if (!bReParse) {
         m_pDocument = FX_NEW CPDF_Document(this);
     }
     FX_BOOL bXRefRebuilt = FALSE;
     if (m_Syntax.SearchWord(FX_BSTRC("startxref"), TRUE, FALSE, 4096)) {
         FX_FILESIZE startxref_offset = m_Syntax.SavePos();
         FX_LPVOID pResult = FXSYS_bsearch(&startxref_offset, m_SortedOffset.GetData(), m_SortedOffset.GetSize(), sizeof(FX_FILESIZE), _CompareFileSize);
         if (pResult == NULL) {
             m_SortedOffset.Add(startxref_offset);
@@ skipping 4230 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }