https://codereview.chromium.org/2283893003

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b80d9eb6c3b98e374b2f8eef570094d66b3406ba

commit b80d9eb6c3b98e374b2f8eef570094d66b3406ba
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Tue Aug 30 05:03:50 2016

Roll src/third_party/pdfium/ 548ea2f7d..35512aa7e (14 commits).

https://pdfium.googlesource.com/pdfium.git/+log/548ea2f7d083..35512aa7e4ac

$ git log 548ea2f7d..35512aa7e --date=short --no-merges --format='%ad %ae %s'
2016-08-29 jaepark Display content of the annotation when mouse hover.
2016-08-29 dsinclair Skip the channel if there is no data.
2016-08-29 tsepez Revert "Add -> operators to CFX_CountRef."
2016-08-29 tsepez Revert "Replace wrapper methods in CPDF_Path with -> operator."
2016-08-29 tsepez Revert "Use ->() in CPDF_ColorState"
2016-08-29 tracy_jiang Fix for #618267. Adding a method to determine if multiplication has overflow.
2016-08-29 dsinclair Verify element exists before accessing.
2016-08-29 tsepez Use ->() in CPDF_ColorState
2016-08-29 stackexploit openjpeg: Prevent an integer overflow in opj_jp2_apply_pclr.
2016-08-29 dsinclair Initialize the CPDF_Document pointer
2016-08-29 tsepez Replace wrapper methods in CPDF_Path with -> operator.
2016-08-29 thestig Add some limit checks to ReadSharedObjHintTable().
2016-08-29 npm Move CFX_SubstFont and CTTFontDesc into their own files
2016-08-29 tonikitoo Fix the test case added in https://codereview.chromium.org/2277063003/

BUG= 62625 , 637232 ,618267, 641076 ,638829, 640998 , 641444 

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2293733002
Cr-Commit-Position: refs/heads/master@{#415132}

[modify] https://crrev.com/b80d9eb6c3b98e374b2f8eef570094d66b3406ba/DEPS

ClusterFuzz has detected this issue as fixed in range 415055:415222.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5485103365226496

Fuzzer: libfuzzer_pdf_hint_table_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory
Crash Address: 
Crash State:
  pdf_hint_table_fuzzer
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=413228:413328
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=415055:415222

Minimized Testcase (0.39 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95tYdyK8p59kbbpG9Zz6s96N3R_gxTnCIMj-EXRhv0VBSyc22CEVKe1WKBfupvN8PQufl22Bddzl2VXUKD8LwPdBB5JTaRmimhDU-bt6O1Kv3-n1OojhSfK6tSoup1JsN1sq4gI8ZDh3QkpKtPnrw871NvPwg?testcase_id=5485103365226496

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot