commit 1c4b767e822a7537f2c6c19b42dddce840e033ee
author npm <npm@chromium.org> Tue Oct 04 13:00:37 2016 -0700
committer Commit bot <commit-bot@chromium.org> Tue Oct 04 13:00:37 2016 -0700
tree 80cc15996d0be9f757702e5fd5f4b1cc715593be
parent fb403875dd1bbf830d9325f10e6a5650db30c6fd

Avoid crashing on CPDF_ToUnicodeMap::Load by using ValueOrDefault()

- Added private method to avoid duplicated code.
- If the unicode calculation overflows, 0 is used instead of crashing.

Review-Url: https://codereview.chromium.org/2392103002

core/fpdfapi/font/font_int.h

diff --git a/core/fpdfapi/font/font_int.h b/core/fpdfapi/font/font_int.h
index 10c2dca..02131eb 100644
--- a/core/fpdfapi/font/font_int.h
+++ b/core/fpdfapi/font/font_int.h
@@ -196,6 +196,8 @@
   static uint32_t StringToCode(const CFX_ByteStringC& str);
   static CFX_WideString StringToWideString(const CFX_ByteStringC& str);
 
+  uint32_t GetUnicode();
+
   std::map<uint32_t, uint32_t> m_Map;
   CPDF_CID2UnicodeMap* m_pBaseMap;
   CFX_WideTextBuf m_MultiCharBuf;

core/fpdfapi/font/fpdf_font.cpp

diff --git a/core/fpdfapi/font/fpdf_font.cpp b/core/fpdfapi/font/fpdf_font.cpp
index 1273ff5..056204a 100644
--- a/core/fpdfapi/font/fpdf_font.cpp
+++ b/core/fpdfapi/font/fpdf_font.cpp
@@ -199,6 +199,12 @@
 
 CPDF_ToUnicodeMap::~CPDF_ToUnicodeMap() {}
 
+uint32_t CPDF_ToUnicodeMap::GetUnicode() {
+  FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
+  uni = uni * 0x10000 + 0xffff;
+  return uni.ValueOrDefault(0);
+}
+
 void CPDF_ToUnicodeMap::Load(CPDF_Stream* pStream) {
   CIDSet cid_set = CIDSET_UNKNOWN;
   CPDF_StreamAcc stream;
@@ -225,10 +231,7 @@
         if (len == 1) {
           m_Map[srccode] = destcode.GetAt(0);
         } else {
-          FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
-          uni *= 0x10000;
-          uni += 0xffff;
-          m_Map[srccode] = uni.ValueOrDie();
+          m_Map[srccode] = GetUnicode();
           m_MultiCharBuf.AppendChar(destcode.GetLength());
           m_MultiCharBuf << destcode;
         }
@@ -259,10 +262,7 @@
             if (len == 1) {
               m_Map[code] = destcode.GetAt(0);
             } else {
-              FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
-              uni *= 0x10000;
-              uni += 0xffff;
-              m_Map[code] = uni.ValueOrDie();
+              m_Map[code] = GetUnicode();
               m_MultiCharBuf.AppendChar(destcode.GetLength());
               m_MultiCharBuf << destcode;
             }
@@ -285,10 +285,7 @@
               } else {
                 retcode = StringDataAdd(destcode);
               }
-              FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
-              uni *= 0x10000;
-              uni += 0xffff;
-              m_Map[code] = uni.ValueOrDie();
+              m_Map[code] = GetUnicode();
               m_MultiCharBuf.AppendChar(retcode.GetLength());
               m_MultiCharBuf << retcode;
               destcode = retcode;