Cleanup call expression handling in fm2js

Remove handling of arbitrary function calls, and only allow supported
function calls. Issues with the lexer being overly permissive led to
large blobs of javascript being dropped into the output. Specifically
driver code was assuming that anything marked as a function would just
be an identifier that could be inserted into the javascript, but the
lexer marks things like ()()() as a function, which would lead to the
following JS being inserted as an identifier.

This change is intended to be a patch for the specific issue that was
being seen from the fuzzer test, and further work will be needed to
make the lexer more strict.

BUG=724913
TEST=Ran fuzzer test case. Ran unittests,embeddertests,corpustests.

Change-Id: Ib7d9239bf6fece853bea0f4915ee4ad72d3cd290
Reviewed-on: https://pdfium-review.googlesource.com/7032
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

1 files changed, 12 insertions, 0 deletions

diff --git a/xfa/fxfa/fm2js/cxfa_fm2jscontext_embeddertest.cpp b/xfa/fxfa/fm2js/cxfa_fm2jscontext_embeddertest.cpp
index 7902bb7c8d..ff2e200186 100644
--- a/xfa/fxfa/fm2js/cxfa_fm2jscontext_embeddertest.cpp
+++ b/xfa/fxfa/fm2js/cxfa_fm2jscontext_embeddertest.cpp
@@ -1432,3 +1432,15 @@ TEST_F(FM2JSContextEmbedderTest, Post) {
 TEST_F(FM2JSContextEmbedderTest, Put) {
   // TODO(dsinclair): Is this supported?
 }
+
+TEST_F(FM2JSContextEmbedderTest, InvalidFunctions) {
+  ASSERT_TRUE(OpenDocument("simple_xfa.pdf"));
+
+  const char* const tests[] = {
+      "F()", "()", "()()()", "Round(2.0)()",
+  };
+
+  for (size_t i = 0; i < FX_ArraySize(tests); ++i) {
+    EXPECT_FALSE(ExecuteSilenceFailure(tests[i]));
+  }
+}