commit a112f85f6c11b171286ec54fca5e0dcf18f9be63
author Nicolas Pena <npm@chromium.org> Wed Oct 11 14:54:11 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Thu Oct 12 15:18:28 2017 +0000
tree 9c99731817872e386f5f0d2561df0f134e1f035b
parent fb6165ff8f8ad1d7725f63e509eb7f7543df231e

Add more checks to fseeks in CFX_FolderFontInfo

Bug: chromium:770890
Change-Id: Iee532d76aabc0763a835c203344455ba07c6e82c
Reviewed-on: https://pdfium-review.googlesource.com/15930
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>

core/fxge/cfx_folderfontinfo.cpp

diff --git a/core/fxge/cfx_folderfontinfo.cpp b/core/fxge/cfx_folderfontinfo.cpp
index 1ee9ea7..6b564f8 100644
--- a/core/fxge/cfx_folderfontinfo.cpp
+++ b/core/fxge/cfx_folderfontinfo.cpp
@@ -54,13 +54,17 @@
 ByteString FPDF_LoadTableFromTT(FILE* pFile,
                                 const uint8_t* pTables,
                                 uint32_t nTables,
-                                uint32_t tag) {
+                                uint32_t tag,
+                                uint32_t fileSize) {
   for (uint32_t i = 0; i < nTables; i++) {
     const uint8_t* p = pTables + i * 16;
     if (GET_TT_LONG(p) == tag) {
       uint32_t offset = GET_TT_LONG(p + 8);
       uint32_t size = GET_TT_LONG(p + 12);
-      fseek(pFile, offset, SEEK_SET);
+      if (offset > std::numeric_limits<uint32_t>::max() - size ||
+          offset + size > fileSize || fseek(pFile, offset, SEEK_SET) < 0) {
+        return ByteString();
+      }
       return FPDF_ReadStringFromFile(pFile, size);
     }
   }
@@ -199,9 +203,8 @@
                                     FILE* pFile,
                                     uint32_t filesize,
                                     uint32_t offset) {
-  fseek(pFile, offset, SEEK_SET);
   char buffer[16];
-  if (!fread(buffer, 12, 1, pFile))
+  if (fseek(pFile, offset, SEEK_SET) < 0 || !fread(buffer, 12, 1, pFile))
     return;
 
   uint32_t nTables = GET_TT_SHORT(buffer + 4);
@@ -209,8 +212,8 @@
   if (tables.IsEmpty())
     return;
 
-  ByteString names =
-      FPDF_LoadTableFromTT(pFile, tables.raw_str(), nTables, 0x6e616d65);
+  ByteString names = FPDF_LoadTableFromTT(pFile, tables.raw_str(), nTables,
+                                          0x6e616d65, filesize);
   if (names.IsEmpty())
     return;
 
@@ -227,8 +230,8 @@
 
   auto pInfo = pdfium::MakeUnique<FontFaceInfo>(path, facename, tables, offset,
                                                 filesize);
-  ByteString os2 =
-      FPDF_LoadTableFromTT(pFile, tables.raw_str(), nTables, 0x4f532f32);
+  ByteString os2 = FPDF_LoadTableFromTT(pFile, tables.raw_str(), nTables,
+                                        0x4f532f32, filesize);
   if (os2.GetLength() >= 86) {
     const uint8_t* p = os2.raw_str() + 78;
     uint32_t codepages = GET_TT_LONG(p);