Cleanup call expression handling in fm2js

Remove handling of arbitrary function calls, and only allow supported
function calls. Issues with the lexer being overly permissive led to
large blobs of javascript being dropped into the output. Specifically
driver code was assuming that anything marked as a function would just
be an identifier that could be inserted into the javascript, but the
lexer marks things like ()()() as a function, which would lead to the
following JS being inserted as an identifier.

This change is intended to be a patch for the specific issue that was
being seen from the fuzzer test, and further work will be needed to
make the lexer more strict.

BUG=724913
TEST=Ran fuzzer test case. Ran unittests,embeddertests,corpustests.

Change-Id: Ib7d9239bf6fece853bea0f4915ee4ad72d3cd290
Reviewed-on: https://pdfium-review.googlesource.com/7032
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

1 files changed, 16 insertions, 7 deletions

diff --git a/testing/xfa_js_embedder_test.cpp b/testing/xfa_js_embedder_test.cpp
index 4a29872eab..e5a30f6b88 100644
--- a/testing/xfa_js_embedder_test.cpp
+++ b/testing/xfa_js_embedder_test.cpp
@@ -53,18 +53,27 @@ bool XFAJSEmbedderTest::OpenDocument(const std::string& filename,
 }
 
 bool XFAJSEmbedderTest::Execute(const CFX_ByteStringC& input) {
-  value_ = pdfium::MakeUnique<CFXJSE_Value>(GetIsolate());
-  if (script_context_->RunScript(XFA_SCRIPTLANGTYPE_Formcalc,
-                                 CFX_WideString::FromUTF8(input).AsStringC(),
-                                 value_.get(), GetXFADocument()->GetRoot())) {
+  if (ExecuteHelper(input)) {
     return true;
   }
 
   CFXJSE_Value msg(GetIsolate());
   value_->GetObjectPropertyByIdx(1, &msg);
-  EXPECT_TRUE(msg.IsString());
-
   fprintf(stderr, "JS: %.*s\n", input.GetLength(), input.c_str());
-  fprintf(stderr, "JS ERROR: %ls\n", msg.ToWideString().c_str());
+  // If the parsing of the input fails, then v8 will not run, so there will be
+  // no value here to print.
+  if (msg.IsString() && !msg.ToWideString().IsEmpty())
+    fprintf(stderr, "JS ERROR: %ls\n", msg.ToWideString().c_str());
   return false;
 }
+
+bool XFAJSEmbedderTest::ExecuteSilenceFailure(const CFX_ByteStringC& input) {
+  return ExecuteHelper(input);
+}
+
+bool XFAJSEmbedderTest::ExecuteHelper(const CFX_ByteStringC& input) {
+  value_ = pdfium::MakeUnique<CFXJSE_Value>(GetIsolate());
+  return script_context_->RunScript(XFA_SCRIPTLANGTYPE_Formcalc,
+                                    CFX_WideString::FromUTF8(input).AsStringC(),
+                                    value_.get(), GetXFADocument()->GetRoot());
+}