XFA: CFX_FontMgrImp::m_Hash2FileAccess vulnerable to hash collsions

[GoogleCodeExporter]

It appears that in both CFX_FontMgrImp::LoadFont()s, either a name 
    bsHash += CFX_WideString(pszFileName).UTF8Encode(); 
or a pointer
    FX_LPVOID Hash[1] = {(FX_LPVOID)(FX_UINTPTR)pFontStream};
    FX_DWORD dwHash = FX_HashCode_String_GetA((FX_LPCSTR)Hash, 1 * sizeof (FX_LPVOID));

is reduced to a key, and then used to index into a map without further 
validation upon return that the item corresponded to the original key.
Furthermore it appears to be storing only one item per key, so that a collision 
loses items, etc.

Undoubtedly the right thing to to is to replace the table with an appropriate 
STL container thus avoiding botches in custom-written containers.

Original issue reported on code.google.com by tsepez@chromium.org on 21 Apr 2015 at 4:43

• Blocked on: #142

[GoogleCodeExporter]

Original comment by tsepez@chromium.org on 21 Apr 2015 at 6:40

• Now blocked on: #142