summaryrefslogtreecommitdiff
path: root/fpdfsdk/src/javascript
diff options
context:
space:
mode:
authorTom Sepez <tsepez@chromium.org>2015-06-02 10:09:49 -0700
committerTom Sepez <tsepez@chromium.org>2015-06-02 10:09:49 -0700
commit4ff7a4246c81a71b4f878e959b3ca304cd76ec8a (patch)
tree2a8002655a6300e69408d08196bb86a6f1b0145f /fpdfsdk/src/javascript
parent8e1b60824d079546c8cc3f0e3d9fa0ea9fa980fa (diff)
downloadpdfium-4ff7a4246c81a71b4f878e959b3ca304cd76ec8a.tar.xz
Fix heap use after free in Document::DoFieldDelay and Document::delay
This fix removes CJS_DelayData object from m_DelayData array and copies them to a new array, before processing them. So contents of m_DelayData array cannot be used after they get freed. BUG=487928 R=tsepez@chromium.org TEST= Chrome pdf plugin should not crash when poc_stable,testuafdocument1.pdf and testuafdocument2.pdf are viewed. see crbug.com/487928 and crbug.com/487928#c18 for more details. Review URL: https://codereview.chromium.org/1163823002
Diffstat (limited to 'fpdfsdk/src/javascript')
-rw-r--r--fpdfsdk/src/javascript/Document.cpp28
1 files changed, 23 insertions, 5 deletions
diff --git a/fpdfsdk/src/javascript/Document.cpp b/fpdfsdk/src/javascript/Document.cpp
index b821f1eca3..6a3d6e1e33 100644
--- a/fpdfsdk/src/javascript/Document.cpp
+++ b/fpdfsdk/src/javascript/Document.cpp
@@ -988,15 +988,25 @@ FX_BOOL Document::delay(IFXJS_Context* cc, CJS_PropValue& vp, CFX_WideString& sE
}
else
{
- for (int i=0,sz=m_DelayData.GetSize(); i<sz; i++)
+ CFX_ArrayTemplate<CJS_DelayData*> DelayDataToProcess;
+
+ for (int i=0,sz=m_DelayData.GetSize(); i < sz; i++)
{
if (CJS_DelayData* pData = m_DelayData.GetAt(i))
{
- Field::DoDelay(m_pDocument, pData);
- delete m_DelayData.GetAt(i);
+ DelayDataToProcess.Add(pData);
+ m_DelayData.SetAt(i, NULL);
}
}
m_DelayData.RemoveAll();
+
+ for (int i=0,sz=DelayDataToProcess.GetSize(); i < sz; i++)
+ {
+ CJS_DelayData* pData = DelayDataToProcess.GetAt(i);
+ Field::DoDelay(m_pDocument, pData);
+ DelayDataToProcess.SetAt(i,NULL);
+ delete pData;
+ }
}
return TRUE;
@@ -1927,6 +1937,7 @@ void Document::AddDelayData(CJS_DelayData* pData)
void Document::DoFieldDelay(const CFX_WideString& sFieldName, int nControlIndex)
{
CFX_DWordArray DelArray;
+ CFX_ArrayTemplate<CJS_DelayData*> DelayDataForFieldAndControlIndex;
for (int i=0,sz=m_DelayData.GetSize(); i<sz; i++)
{
@@ -1934,8 +1945,7 @@ void Document::DoFieldDelay(const CFX_WideString& sFieldName, int nControlIndex)
{
if (pData->sFieldName == sFieldName && pData->nControlIndex == nControlIndex)
{
- Field::DoDelay(m_pDocument, pData);
- delete pData;
+ DelayDataForFieldAndControlIndex.Add(pData);
m_DelayData.SetAt(i, NULL);
DelArray.Add(i);
}
@@ -1946,6 +1956,14 @@ void Document::DoFieldDelay(const CFX_WideString& sFieldName, int nControlIndex)
{
m_DelayData.RemoveAt(DelArray[j]);
}
+
+ for (int i=0,sz=DelayDataForFieldAndControlIndex.GetSize(); i < sz; i++)
+ {
+ CJS_DelayData* pData = DelayDataForFieldAndControlIndex.GetAt(i);
+ Field::DoDelay(m_pDocument, pData);
+ DelayDataForFieldAndControlIndex.SetAt(i,NULL);
+ delete pData;
+ }
}
void Document::AddDelayAnnotData(CJS_AnnotObj *pData)