XFA: bound memcpy length in _png_load_bmp_attribute()

core/src/fxcodec/codec/fx_codec_png.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fxge/fx_dib.h"
 #include "codec_int.h"
 extern "C" {
@@ skipping 51 matching lines @@
         FX_DWORD len;
         FX_LPCSTR buf;
         int num_text;
         png_textp text = NULL;
         png_get_text(png_ptr, info_ptr, &text, &num_text);
         for (i = 0; i < num_text; i++) {
             len = (FX_DWORD)FXSYS_strlen(text[i].key);
             buf = "Time";
             if (!FXSYS_memcmp32(buf, text[i].key, FX_MIN(len, FXSYS_strlen(buf)))) {
                 if (!bTime) {
-                    FXSYS_memset32(pAttribute->m_strTime, 0, 20);
-                    FXSYS_memcpy32(pAttribute->m_strTime, text[i].text, text[i].text_length);
+                    FXSYS_memset32(pAttribute->m_strTime, 0, sizeof(pAttribute->m_strTime));
+                    FXSYS_memcpy32(pAttribute->m_strTime, text[i].text,
+                                   FX_MIN(sizeof(pAttribute->m_strTime) - 1, text[i].text_length));
                 }
             } else {
                 buf = "Author";
                 if (!FXSYS_memcmp32(buf, text[i].key, FX_MIN(len, FXSYS_strlen(buf)))) {
                     pAttribute->m_strAuthor.Empty();
                     pAttribute->m_strAuthor.Load((FX_LPBYTE)text[i].text, (FX_STRSIZE)text[i].text_length);
                 }
             }
         }
 #endif
@@ skipping 154 matching lines @@
     FXPNG_Context* p = (FXPNG_Context*)pContext;
     if(setjmp(png_jmpbuf(p->png_ptr))) {
         if (pAttribute && 0 == FXSYS_strcmp(m_szLastError, "Read Header Callback Error")) {
             _png_load_bmp_attribute(p->png_ptr, p->info_ptr, pAttribute);
         }
         return FALSE;
     }
     png_process_data(p->png_ptr, p->info_ptr, (FX_LPBYTE)src_buf, src_size);
     return TRUE;
 }