Add CPDFToUnicodeMapTest.HandleBeginBFRangeRejectsMismatchedBracket

Demonstrate how CPDF_ToUnicodeMapTest parsing is too loose and does not
check a '[' has a matching ']'.

Change-Id: I6e0bc7e9293f801649ba3ef0a9be449f14dcca4a
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/126050
Reviewed-by: Thomas Sepez <tsepez@google.com>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/font/cpdf_tounicodemap_unittest.cpp b/core/fpdfapi/font/cpdf_tounicodemap_unittest.cpp
index cafa594..4f5d41d 100644
--- a/core/fpdfapi/font/cpdf_tounicodemap_unittest.cpp
+++ b/core/fpdfapi/font/cpdf_tounicodemap_unittest.cpp
@@ -110,6 +110,15 @@
   }
 }
 
+TEST(CPDFToUnicodeMapTest, HandleBeginBFRangeRejectsMismatchedBracket) {
+  static constexpr uint8_t kInput[] = "1 beginbfrange<3><3>[<0041>}endbfrange";
+  auto stream = pdfium::MakeRetain<CPDF_Stream>(kInput);
+  CPDF_ToUnicodeMap map(stream);
+  // TODO(thestig): The calls below should both return 0.
+  EXPECT_EQ(3u, map.ReverseLookup(0x0041));
+  EXPECT_EQ(1u, map.GetUnicodeCountByCharcodeForTesting(3u));
+}
+
 TEST(CPDFToUnicodeMapTest, HandleBeginBFRangeGoodCount) {
   static constexpr uint8_t kInput[] =
       "2 beginbfrange<1><2><0040><4><5><0050>endbfrange";