Check for bad values of startxref.

The startxref value should not point into the PDF file header.

BUG=chromium:913960

Change-Id: Id1bcf9c0dafa8853f2dda5564e8b5d6407fe4bd8
Reviewed-on: https://pdfium-review.googlesource.com/c/47351
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fpdfapi/parser/cpdf_parser.cpp

diff --git a/core/fpdfapi/parser/cpdf_parser.cpp b/core/fpdfapi/parser/cpdf_parser.cpp
index 08d5a33..dd885bc 100644
--- a/core/fpdfapi/parser/cpdf_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_parser.cpp
@@ -166,8 +166,7 @@
   bool bXRefRebuilt = false;
 
   m_LastXRefOffset = ParseStartXRef();
-
-  if (m_LastXRefOffset > 0) {
+  if (m_LastXRefOffset >= kPDFHeaderSize) {
     if (!LoadAllCrossRefV4(m_LastXRefOffset) &&
         !LoadAllCrossRefV5(m_LastXRefOffset)) {
       if (!RebuildCrossRef())

core/fpdfapi/parser/cpdf_parser.h

diff --git a/core/fpdfapi/parser/cpdf_parser.h b/core/fpdfapi/parser/cpdf_parser.h
index 6d0b9b5..f0d497b 100644
--- a/core/fpdfapi/parser/cpdf_parser.h
+++ b/core/fpdfapi/parser/cpdf_parser.h
@@ -125,6 +125,7 @@
   std::unique_ptr<CPDF_SyntaxParser> m_pSyntax;
 
  private:
+  friend class cpdf_parser_BadStartXrefShouldNotBuildCrossRefTable_Test;
   friend class cpdf_parser_ParseStartXRefWithHeaderOffset_Test;
   friend class cpdf_parser_ParseStartXRef_Test;
   friend class cpdf_parser_ParseLinearizedWithHeaderOffset_Test;

core/fpdfapi/parser/cpdf_parser_unittest.cpp

diff --git a/core/fpdfapi/parser/cpdf_parser_unittest.cpp b/core/fpdfapi/parser/cpdf_parser_unittest.cpp
index 7012bd6..d7f96b8 100644
--- a/core/fpdfapi/parser/cpdf_parser_unittest.cpp
+++ b/core/fpdfapi/parser/cpdf_parser_unittest.cpp
@@ -284,3 +284,20 @@
 
   EXPECT_TRUE(parser.ParseLinearizedHeader());
 }
+
+TEST(cpdf_parser, BadStartXrefShouldNotBuildCrossRefTable) {
+  const unsigned char kData[] =
+      "%PDF1-7 0 obj <</Size 2 /W [0 0 0]\n>>\n"
+      "stream\n"
+      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n"
+      "endstream\n"
+      "endobj\n"
+      "startxref\n"
+      "6\n"
+      "%%EOF\n";
+  CPDF_TestParser parser;
+  ASSERT_TRUE(parser.InitTestFromBuffer(kData));
+  EXPECT_EQ(CPDF_Parser::FORMAT_ERROR, parser.StartParseInternal());
+  ASSERT_TRUE(parser.GetCrossRefTable());
+  EXPECT_EQ(0u, parser.GetCrossRefTable()->objects_info().size());
+}