tree ea1d43432ed7a249be66eee71468a6339b7c7755
parent ceaa31b826614b69a1f8d2f1149186d9491a9ac0
author Hui Yingst <nigi@chromium.org> 1657824638 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> 1657824638 +0000

Avoid integer overflow in CPDF_ToUnicodeMap::HandleBeginBFRange()

In CPDF_ToUnicodeMap::HandleBeginBFRange(), there are 3 for-loops
which increase `code` values in the range between `lowcode` and
`highcode`. If `highcode` is 0xffffffff, the "code++" operation will
cause integer overflow and these for-loops will never be terminated.

Make `code` FX_SAFE_UINT32 type so that its value can be validated
for each for-loop to avoid integer overflow.

Bug: chromium:1343510
Change-Id: Icb8221ce026fade90b01151c6f675b9a4d3b2f2b
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/95310
Commit-Queue: Nigi <nigi@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>