summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-09-26Strengthen bounds check in CWeightTable::Calc.stackexploit
The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t, m_dwWeightTablesSize), but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx >= m_dwWeightTablesSize)| in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ? &pWeight->m_Weights[idx] : nullptr| in function CWeightTable::GetValueFromPixelWeight() were insufficient. This CL strengthens bounds check for accessing int type array PixelWeight.m_Weights. BUG=chromium:619398 R=ochang@chromium.org, thestig@chromium.org Review-Url: https://codereview.chromium.org/2322903002
2016-09-26De-virtualize CPDFSDK_AnnotHandlerMgrtsepez
It has no sub-classes or super-classes, so no need for virtual. Review-Url: https://codereview.chromium.org/2365383003
2016-09-26Fix memory leak in cmap parsingkcwu
found by libfuzzer Review-Url: https://codereview.chromium.org/2366143002
2016-09-26Add fuzzer for cmap parsingchromium/2873kcwu
Review-Url: https://codereview.chromium.org/2365143002
2016-09-26Fix memory leak in lcms, MPEmatrix_Readkcwu
BUG=650277 Review-Url: https://codereview.chromium.org/2371723003
2016-09-23Remove FX_BOOL from cpdf_fontchromium/2872chromium/2871chromium/2870npm
In all cases, bool can be used instead without problems. Review-Url: https://codereview.chromium.org/2368693002
2016-09-23Clean CPDF_CIDFont a littlenpm
Remove C-casts, nits. Review-Url: https://codereview.chromium.org/2367743003
2016-09-23Avoid collisions in CPDF_IndirectObjectHolder::AddIndirectObject()tsepez
The change at 5b7c9bb differed from the original code in that a pre-existing object would now be freed, which showed that a collision could be possible if m_LastObjNum overflowed. BUG=649206 Review-Url: https://codereview.chromium.org/2361303002
2016-09-23Bail out on bad width and height in CCodec_FaxDecoder::CreateDecoderkcwu
BUG=648935,649436 Review-Url: https://codereview.chromium.org/2360283004
2016-09-23Make CPDF_Font::Create() return a std::unique_ptr.tsepez
Review-Url: https://codereview.chromium.org/2364643003
2016-09-22Make CPDF_ColorSpace::Load() return a unique_ptrtsepez
Specialize default_delete to avoid having to say ReleaseDeleter<CPDF_ColorSpace> throughout the code. Review-Url: https://codereview.chromium.org/2368433003
2016-09-22Fix memory leaks in lcmskcwu
found by libfuzzer Review-Url: https://codereview.chromium.org/2359243003
2016-09-22Rename CPDF_CountedObject to CFX_WeakPtr::Handlechromium/2869tsepez
This better describes its purpose, and reduces confusion with the CFX_CountRef class, which is unrelated. The WeakPtr class itself that manipulates handles is NYI. Review-Url: https://codereview.chromium.org/2366673003
2016-09-22Make creation of CPDFSDK_Document clearerdsinclair
Move the creation of the CPDFSDK_Document into FPDFDOC_InitFormFillEnvironment instead of hidden inside a Get method in CDPFXFA_Document. Review-Url: https://codereview.chromium.org/2353303004
2016-09-22Fix use uninitialized value and stack buffer overflow readkcwu
Found by libfuzzer Review-Url: https://codereview.chromium.org/2362813002
2016-09-22Fix infinite loop when calling GrowNamedColorListkcwu
Handle the case that GrowNamedColorList return fail when list is too long. Otherwise the loop never ends. Found by libfuzzer Review-Url: https://codereview.chromium.org/2365663002
2016-09-22Null CPDF_CountedObj::m_pObj prior to deletiontsepez
This gives additional protection in case of re-entry. Also make CFX_CountRef more robust in face of errors. BUG=649229 Review-Url: https://codereview.chromium.org/2364673002
2016-09-22Rename App to Env where needed.dsinclair
More instances of CPDFSDK_Environment being called m_pApp in the code. Renamed to m_pEnv to be clear that it's the environment not an app object. Review-Url: https://codereview.chromium.org/2354413002
2016-09-22Simplify memory management for per isolate dataweili
Use smart pointers for FXJS_PerIsolateData owned member variables. Also move creation and deletion of dynamic object map into FXJS_PerIsolateData's constructor and destructor. Overall, the interfaces and memory management should be simpler. BUG=pdfium:518 Review-Url: https://codereview.chromium.org/2358343002
2016-09-22Add fuzzer for icc codeckcwu
Review-Url: https://codereview.chromium.org/2362623002
2016-09-22Move CPDFSDK_Environment code to cpp filedsinclair
This CL moves the code from the .h file into the .cpp file. Review-Url: https://codereview.chromium.org/2354363003
2016-09-21Remove some objnum locals with AddIndirectObjecttsepez
Also, it's idempotent, so simplify some logic in callers to not care if objnum is zero. The alternate forms are rarely used, using the objnum form makes it clear that SetReferenceFor() can't possibly register the object as a side-effect. Review-Url: https://codereview.chromium.org/2361713002
2016-09-21Move win_xfa_clang bot back into regular commit queueweili
win_xfa_clang bot was marked as experimental due to https://crbug.com/626120 which was fixed a while ago. Now no longer need to keep it as experimental. Review-Url: https://codereview.chromium.org/2363603002
2016-09-21Use unique_ptr<CPDF_Object, ReleaseDeleter<>> in more placeschromium/2868tsepez
Review-Url: https://codereview.chromium.org/2358243002
2016-09-21Make ownership explicit in CPDF_ContentMarkItem.tsepez
The old SetParam() method had "maybe take ownership" semanitcs based upon the type argument. Make GetParam() handle the None case and simplify callers based upon that behaviour. Review-Url: https://codereview.chromium.org/2358043003
2016-09-21Check for overflow in CMap_GetCode.dsinclair
Given a large enough value for the character code it's possible to overflow the conversion to an int. This Cl updates the code to guard against overflow. BUG=chromium:648739 Review-Url: https://codereview.chromium.org/2358023002
2016-09-21Avoid static initializers and global variables in 'pdfium_test'.tonikitoo
This CL aims to follow up on thestig's past-land feedback receveid on https://codereview.chromium.org/2277063003/#msg15 . In order to avoid static initializers and global data declaration, CL adds a data struct named PDFiumTest_FPDF_FORMFILLINFO, which has FPDF_FORMFILLINFO as the first struct member definition. This allows the use of reinterpret_cast to/from PDFiumTest_FPDF_FORMFILLINFO and PDF_FORMFILLINFO. PDFiumTest_FPDF_FORMFILLINFO also two more struct members, 'loadedPages' and 'formHandle', which were previously global variables. Review-Url: https://codereview.chromium.org/2330043002
2016-09-21Clear LeakSanitizer's suppression listweili
We have cleared all the leaks in our code. There is no need for those suppressions. Plus, most of them are obsolete due to code refactoring. Still keep this file around so that suppressions can be added if needed in the future. BUG=pdfium:242,pdfium:260 Review-Url: https://codereview.chromium.org/2360743002
2016-09-21Make the I in IFormFiller explicitdsinclair
Typically the I prefix means Interface, except for CFFL_IFormFiller where it means Interactive. Rename CFFL_IFormFiller to CFFL_InteractiveFormFiller to make the meaning explicit. Review-Url: https://codereview.chromium.org/2357203003
2016-09-21Set up isolate in CFXJS_Engine's constructorweili
CFXJS_Engine class should always be constructed with an isolate, except for its subclasses which may need to create an isolate by themselves. Move SetIsolate() function to be protected so that only subclasses can access it. Review-Url: https://codereview.chromium.org/2354353002
2016-09-21Fix leaks related to the usage of JSE runtime dataweili
Per isolate runtime data should be deleted when the associated isolate's destructed. Also, the internal of per isolate runtime data is obscure to the JS engine. So XFA or this class itself has to be in charge of the memory management. Use smart pointer for it so that the resource could be released properly. BUG=pdfium:242 Review-Url: https://codereview.chromium.org/2354923003
2016-09-21Rename m_pApp to m_pEnvdsinclair
The m_pApp variable holds a CPDFSDK_Environment. This Cl renames the variable to be m_pEnv so as not to confuse with the various App classes that exist. Review-Url: https://codereview.chromium.org/2357293002
2016-09-21Delete unused methods in CPDF_Parsernpm
Review-Url: https://codereview.chromium.org/2353383002
2016-09-20Change protected to private in CPDF_CID2UnicodeMap and CPDF_ToUnicodeMapchromium/2867npm
Review-Url: https://codereview.chromium.org/2356603003
2016-09-20Delete unused methods and variables in CPDF_CMapManagernpm
and in CPDF_CMapParser Review-Url: https://codereview.chromium.org/2353963003
2016-09-20Delete unused GetBitMap() in fx_agg_drivernpm
Review-Url: https://codereview.chromium.org/2353143002
2016-09-20Make CPDF_Array not do indirect object creation.tsepez
We remove the indirect object holder argument and check that call sites pass ownable objects, adding a reference in one place that always was passing an indirect object. Also check that the invariant isn't violated, we need to fail here in the wild and investigate -- these are existing UAFs. Review-Url: https://codereview.chromium.org/2355083002
2016-09-20CPDF_Document friend cleanupdsinclair
Remove CPDF_Creator and CPDF_Parser as friends of CPDF_Document. Move all member variables to the private section, and add CPDF_TestDocument as a private friend. Review-Url: https://codereview.chromium.org/2349353003
2016-09-20CPDF_OCContext and CPDF_Document are no longer friendsdsinclair
Remove friendship as there doesn't appear to be anything protected that is being accessed by CPDF_OCContext. Review-Url: https://codereview.chromium.org/2355823002
2016-09-20CPDF_Document and CPDF_DataAvail are no longer friendsdsinclair
Remove the friendship between these two classes and replace with accessor methods. Review-Url: https://codereview.chromium.org/2355813002
2016-09-20Cleanup CPDFXFA and CPDF document methodsdsinclair
This CL renames and cleans up some methods that are similar between CPDF_Document and CPDFXFA_Document. Review-Url: https://codereview.chromium.org/2351673004
2016-09-20Re-land "Make CPDF_IndirectObjectHolder use unique_ptr to objects""tsepez
This reverts commit 81e1e3fd2d33478733e47bd007b76fac1a663e74. Review-Url: https://codereview.chromium.org/2353013003
2016-09-20Fix memory leaking on ClosePage.art-snake
BUG=79367, 48791 The fonts was not cleared after unloading pages. Test pdf: http://www.nasa.gov/pdf/750614main_NASA_FY_2014_Budget_Estimates-508.pdf For this file, we have ~5 fonts per page, which equal ~1 Mb per page. In this PDF we have 670 pages, as result after slow scrolling(reading) full document we have ~600 Mb fonts data in memory. Memory usage of PDF Plugin: before this CL: ~660 Mb after this CL: ~100 Mb This is last part of reverted CL: Original CL: https://codereview.chromium.org/2158023002 Revert reason: BUG=647612 Fix bug CL: https://codereview.chromium.org/2350193003 Previous CL: https://codereview.chromium.org/2350243002 Review-Url: https://codereview.chromium.org/2351193002
2016-09-20Assert that dictionary can own the objects it is given.tsepez
Upon indirect object holder destruction, all indirect objects are destroyed -- currently by order of increasing object number -- but ideally without ordering constraints. So currently, we can get away with a dictionary pointing directly at an indirect object with a higher number. It gets destroyed first, invoking Release() on its subordinates, which skips destroying them if they are indirect objects. But we don't want to rely on this artifact of destruction order. Should it happen to be reversed, the dictionary would invoke Release() on freed memory. Interestingly, CPDF_Array skirts the issue by replacing any indirect objects it is given with references. Not clear whether we should do the same thing for dictionaries, or remove it from arrays. The technique certainly complicates understanding ownership. The one violation found is in the unittest that broke the previous CL which tried to use unique_ptrs in indirect object holder. Review-Url: https://codereview.chromium.org/2353093002
2016-09-20Refactor CFX_FontCache to have only one in GE Module.art-snake
After this CL: only one global CFX_FontCache used. Any cached items from it, are released, when they are not being used. This is restore part of reverted CL: Original CL: https://codereview.chromium.org/2158023002 Revert reason: BUG=647612 Fix bug CL: https://codereview.chromium.org/2350193003 Review-Url: https://codereview.chromium.org/2350243002
2016-09-20Fix nullptr dereference in FPDF_GenerateAP().thestig
BUG=645954 Review-Url: https://codereview.chromium.org/2355733002
2016-09-20Fix stack exhaustion in CPDF_PSProc::Parse()tsepez
BUG=648059 Review-Url: https://codereview.chromium.org/2350013003
2016-09-19Revert "Make CPDF_IndirectObjectHolder use unique_ptr to objects"Tom Sepez
This reverts commit c8544d634a1993e2592e41458be215fcd0956031. TBR=dsinclair@chromium.org Review URL: https://codereview.chromium.org/2355683002 .
2016-09-19Make CPDF_IndirectObjectHolder use unique_ptr to objectstsepez
The objects it is given are owned by it and are simply deleted without regard to Release() used by others. Review-Url: https://codereview.chromium.org/2350263002
2016-09-19Remove CPDF_Object::Destroy { delete this; }chromium/2866tsepez
We can delete this just fine on our own. Review-Url: https://codereview.chromium.org/2355593002
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 22:40:28 +0000