Age | Commit message (Collapse) | Author |
|
This CL removes two patches that correspond to non-security CF bugs.
There are now only a few patches left: two patches to prevent overflow
in _TIFFCheckRealloc (overflows here are dangerous as they can cause
heap-buffer-overflows), one patch to prevent integer overflows which CF
reported as a security issue, and one recent upstream patch (which would
be removed in the next LibTIFF upgrade).
Next steps:
* Figure out how to reproduce the security issue from _TIFFCheckRealloc
(samples from the bugs seem to just timeout on asan) and report bug
upstream once it's confirmed that a change is needed.
* Ditto integer overflow, except it was already reported upstream, so
ping upstream once reproduction without the patch is possible again.
Change-Id: I6f9096a6e69698d5ded6a59c4aca5e07b351e716
Reviewed-on: https://pdfium-review.googlesource.com/8532
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>
|
|
This CL adds two helper class to CPWL_AppStream to make sure we
correctly close stream commands.
Change-Id: I017477b16951e3e32a19e6264e63c9927bea5618
Reviewed-on: https://pdfium-review.googlesource.com/8315
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
This CL removes the CLST_Rect and uses CFX_FloatRect directly. The
constructor params for CLST_Rect were (left, top, right, bottom) and
CFX_FloatRect (left, bottom, right, top) so the usages have been
flipped.
Change-Id: I78bb2927c4ff9d5ad6d28099dd08a5bdda7646b0
Reviewed-on: https://pdfium-review.googlesource.com/8432
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
The CFX_ListItem never calls the Height() method so doesn't need to use
CLST_Rect. This CL removes unused methods from CLST_Rect and
CPVT_FloatRect.
Change-Id: I82d4f07ec104345e9275ccd838e3c8eed1de7a50
Reviewed-on: https://pdfium-review.googlesource.com/8431
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
Originally this would only calculate the length of the passed in
string if the passed in length was -1. This causes issues, since other
negative values will be passed straight through and break the
post-condition on the constructor of the length being
non-negative. This leads to undefined and hard to debug behaviour
later, in cases where the root cause is a mistake in calculating the
proper length.
The other related classes, CFX_WideString & CFX_ByteString, test for
all negative length values and calculating the length when they
occur. This CL changes the FooC versions to use this logic. This
implicitly assumes the string is null terminated, so in the incase of
an incorrect negative length and a non-null terminated string there
will still be a crash, but it will now occur at construction time,
instead of at some random later time.
BUG=pdfium:827
Change-Id: I4d1fed746ada67c496d8e6ab10861b9332555023
Reviewed-on: https://pdfium-review.googlesource.com/8450
Reviewed-by: dsinclair <dsinclair@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
|
|
Replace uint8_t type to enum for ObjectType variables
Change-Id: Ie33c8c9413c5082397a2c6fbf73e03f08b7d8658
Reviewed-on: https://pdfium-review.googlesource.com/8470
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
This CL upgrades LibTIFF, removing patch files that correspond to bugs
that have been resolved in 4.0.8.
Change-Id: Id99d2fc9b3f25993dcb60cf1558b73674eb725bf
Reviewed-on: https://pdfium-review.googlesource.com/8490
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>
|
|
This is another case where JS may lead to destruction of
an object far away from where we are holding it.
Bug: 737023
Change-Id: I994d5425184b8c00b5cfaeb95dbb5032a6e09edb
Reviewed-on: https://pdfium-review.googlesource.com/8350
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
|
|
This CL moves the AppSteam generation code for CPWL_Icon to a separate
method. The CPWL_Image code is also folded directly into CPWL_Icon as it
is the only subclass.
Change-Id: I7936bac4af76e34d0f73d48ca00f5713c5f20095
Reviewed-on: https://pdfium-review.googlesource.com/8314
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
This CL moves the remaining appearance stream code to CPWL_AppStream.
The unused GetThisAppearanceStream methods have been removed.
Change-Id: I0bdfbb11962ee7975394a40a1ea45d076ee9151d
Reviewed-on: https://pdfium-review.googlesource.com/8312
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
|
|
This CL creates CJBig2_HTRDProc::decode_image to reduce duplicated code
in the class.
Change-Id: Ie348179c96ff534f95cba401c4b9bd46e1c4e6ac
Reviewed-on: https://pdfium-review.googlesource.com/8410
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>
|
|
Given a point on a page, this method returns the interactive form
annotation whose rectangle contains that point. If there is no such
annotation, nullptr is returned. FPDFPage_CloseAnnot() must be called
after the annotation this method returns is no longer needed.
The tests for this method use the returned annotation to check its
interactive form annotation flags via
FPDFAnnot_GetFormFieldFlags().
BUG=chromium:59266
Change-Id: I8728792bea5367c172e08fdb6bae83eafb70eb68
Reviewed-on: https://pdfium-review.googlesource.com/7970
Commit-Queue: Diana Gage <drgage@google.com>
Reviewed-by: Lei Zhang <thestig@chromium.org>
|
|
Given an interactive form annotation, this method returns its annotation
flags. The flags returned are dependent upon the "Ff" field, and are
specific to interactive form annotations, such as
FPDF_FORMFLAG_MULTILINE, FPDF_FORMFLAG_COMBO, FPDF_FORMFLAG_EDIT, and
others.
To test this method more thoroughly, text_form_multiple.pdf has been
added, which is similar to text_form.pdf, but includes a read-only text
field.
BUG=chromium:59266
Change-Id: Ie66046de273f69a1be6f04a433351ebaa271f60c
Reviewed-on: https://pdfium-review.googlesource.com/7851
Commit-Queue: Diana Gage <drgage@google.com>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
Since there is no guarantee of termination if the StringC was
extracted from a snippet of another string. Make it more obvious
that things like
strlen(str.unterminated_c_str())
might be a bad idea.
Change-Id: I7832248ed89ebbddf5c0bcd402aac7d40ec2adc2
Reviewed-on: https://pdfium-review.googlesource.com/8170
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
|
|
copy and pasted code does not
always work out for the best.
This makes the code compile.
R=dsinclair@chromium.org
Bug:736695
Change-Id: I41474fef629813fd21a5f52e5c7954329b7b2a64
Reviewed-on: https://pdfium-review.googlesource.com/8330
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
This method is never called. Removed.
Change-Id: Iff366d68b4865d195d50a6c37376e81a5a4408b2
Reviewed-on: https://pdfium-review.googlesource.com/8313
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
This CL creates a CPWL_AppStream and consolidates app stream generation
code from CPDFSDK_Widget, CPDFSDK_BAAnnot and CPWL_Utils. The remaining
app stream code from CPWL_Utils will be cleaned up in a future CL.
Change-Id: I20cfdec09a351bd509241d2c667a182fba84b0c1
Reviewed-on: https://pdfium-review.googlesource.com/8310
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
|
|
PDFium doesn't strip BOMs during parsing, but we should strip BOMs when
retrieving parsed strings in CPDF_NameTree to ensure consistency and
appropriate function behavior. See the bug for more info.
As outlined in Bug=pdfium:593, the solution is to call GetUnicodeText()
instead of GetString(). I added a GetUnicodeTextAt() function in
CPDF_Array, which is symmetrical to GetUnicodeTextFor() in
CPDF_Dictionary.
I then changed the input variable types to CPDF_NameTree functions to
be CFX_WideString instead of CFX_ByteString, and modified all the
calls to them.
I also added a unit test for nametree, which would fail prior to this
change. Nametrees with non-unicode names are already tested by embedder
tests.
Bug=pdfium:820
Change-Id: Id69d7343632f83d1f5180348c0eea290f478183f
Reviewed-on: https://pdfium-review.googlesource.com/8091
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Jane Liu <janeliulwq@google.com>
|
|
Respin of https://pdfium-review.googlesource.com/c/6592 with fixes
that avoid invalid reads.
Bug: pdfium:731
Change-Id: I9395063505ba1a5c610e21b089ab8aa1a0a5b86f
Reviewed-on: https://pdfium-review.googlesource.com/8290
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
|
|
If Skia has cached some drawing, flush it
when progressive rendering at the same
point in the pipeline as the non-progressive
state.
R=dsinclair@chromium.org
Bug:736695
Change-Id: Ie24544a4be541ac8a5165dc064171772dd8893da
Reviewed-on: https://pdfium-review.googlesource.com/8270
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Cary Clark <caryclark@google.com>
|
|
This reverts commit 7ca47d55c9cbbec7e0a0b0beffffe348ae655086.
Reason for revert: Caused pdfium:821
Original change's description:
> Converting CFX_ByteTextBuf to ostringstream in SAX.
>
> Bug: pdfium:731
> Change-Id: Ic492e8900c4a69082ff9c2384006a4e6bfa3313e
> Reviewed-on: https://pdfium-review.googlesource.com/6592
> Reviewed-by: Lei Zhang <thestig@chromium.org>
> Reviewed-by: dsinclair <dsinclair@chromium.org>
> Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
TBR=thestig@chromium.org,dsinclair@chromium.org,hnakashima@chromium.org
Bug: pdfium:731
Change-Id: Ic7390c3f53d67d6eecf7f669e329702daa16f339
Reviewed-on: https://pdfium-review.googlesource.com/8230
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
1. Added --save-attachments flag in pdfium_test to save embedded
attachments using fpdf_attachment APIs.
Bug=pdfium:174
Change-Id: I62f09aeb0ab1431f6e127da389518878a7214423
Reviewed-on: https://pdfium-review.googlesource.com/7990
Commit-Queue: Jane Liu <janeliulwq@google.com>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
Bug=pdfium:817
Change-Id: I97d1c306865aad78b7ed11c68cee30f968ab6a66
Reviewed-on: https://pdfium-review.googlesource.com/8051
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
1. Added API for extracting attachment properties and data.
* Expanded the embedder test to cover all the new APIs.
Bug=pdfium:174
Change-Id: I09bffd412410e9aea45faca442d2b72eefafef4e
Reviewed-on: https://pdfium-review.googlesource.com/7790
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
This CL removes the JBig2_GsidProc since it is only used as a single
instance in each of the methods in CJBig2_HTRDProc, so it is completely
unnecessary.
Change-Id: I69d0a4a059b9eb6ebcbbb79b92ea1cd6c22cb1cb
Reviewed-on: https://pdfium-review.googlesource.com/7930
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
Use the overloaded << operator, which takes length into account
for StringC types, rather than a raw ptr (which gets promoted into
a std::string resulting in a length call that overflows since
StringCs aren't necessarily nul-terminated).
Bug: 746073
Change-Id: Iffbbff53e12da8741acc7ce54000232cc66d83bc
Reviewed-on: https://pdfium-review.googlesource.com/8150
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
BUG=chromium:738303
Change-Id: If36cdc0f53fc224c0c4c8cf775fd2c916f2d0add
Reviewed-on: https://pdfium-review.googlesource.com/8210
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
R=thestig@chromium.org
Change-Id: I8af51bec8ddfdee8c61806b844f0ca9a2b8c8c20
Reviewed-on: https://pdfium-review.googlesource.com/8190
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
|
|
When Chrome renders PDF pages it uses the progressive renderer. The one
shot renderer is used to render print preview pages. This CL changes
pdfium_test to use the progressive renderer by default to better match
Chrome. This also adds a --render-oneshot flag which will use the
non-progressive renderer.
Bug: chromium:736695
Change-Id: If79333ae10a0ed1c9bce1290caad8d531e6709aa
Reviewed-on: https://pdfium-review.googlesource.com/8130
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
Avoid duplicate definitions.
Change-Id: I33761277cceea538b8d58c10175cfc9e9951fcd4
Reviewed-on: https://pdfium-review.googlesource.com/8011
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
|
|
This CL adds a FPDF_RENDER_TOBECONTINUED and marks
FPDF_RENDER_TOBECOUNTINUED as deprecated.
Change-Id: Ie08dbb2715d1d7959fbae17d9f23d7fcec410600
Reviewed-on: https://pdfium-review.googlesource.com/8070
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
BUG=pdfium:797
Change-Id: I70d1b2260db1f71b018505aaeca617c5366d9ae5
Reviewed-on: https://pdfium-review.googlesource.com/8050
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
|
|
This CL adds the missing STDCALL annotations from the PDFium APIs.
Bug: pdfium:818
Change-Id: I415efbb68f6f90cc367a4fc7289619764b528ade
Reviewed-on: https://pdfium-review.googlesource.com/8031
Reviewed-by: Nicolás Peña <npm@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>
|
|
Bug:
Change-Id: Ic40d1fce83b6b13f638c522205a765c20f6ccd50
Reviewed-on: https://pdfium-review.googlesource.com/8090
Commit-Queue: Mike Reed <reed@google.com>
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Reviewed-by: Cary Clark <caryclark@google.com>
|
|
This makes the lexer stricter on valid characters for identifiers, and
conform to the grammar in the FormCalc spec. This should remove a
class of inputs that ClusterFuzz is attempting that are breaking later
stages of the transpile.
BUG: chromium:736234, pdfium:783, pdfium:784
Change-Id: I3987d6778a82b71d768fa751035993c0af2577ee
Reviewed-on: https://pdfium-review.googlesource.com/8010
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
Adds script coverage_report.py for generating code coverage
reports. This script depends on the llvm-gcov wrapper script and the
lcovrc config file that are checked in with it.
BUG=pdfium:797
Change-Id: I0416349186835c0e4dd7f4907d2b472a4406e027
Reviewed-on: https://pdfium-review.googlesource.com/7810
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
|
|
https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+log/cf8d9b4ce3fa..38bdf22bfe68
$ git log cf8d9b4ce..38bdf22bf --date=short --no-merges --format='%ad %ae %s'
2017-07-13 wl [truetype] Improve code comment.
2017-07-13 wl [base] Fix memory leak.
2017-07-12 wl [base] Integer overflow.
2017-07-12 wl Document how to scale manually.
2017-07-12 wl CHANGES: Add information on global metrics rounding.
2017-07-12 wl * src/truetype/ttpload.c (tt_face_get_location): Off-by-one typo.
2017-07-11 htl10 Changelog: typo, chromium issue id is 2276 instead of 2278
2017-07-07 wl [cff] Integer overflow.
2017-07-06 apodtele Tweak suggested use of `lsb_delta' and `rsb_delta'.
TBR=thestig@chromium.org
BUG: pdfium:812
Change-Id: Iaabe11da93752dcbe9c1e7ac80b6758010e074ba
Reviewed-on: https://pdfium-review.googlesource.com/8030
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
Re-work the previous fix to be even more particular
about the input.
Bug: chromium:740166
Change-Id: I6bea3b6a6dd320a83f830b07afd52951be7d1b63
Reviewed-on: https://pdfium-review.googlesource.com/7691
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
This CL removes the drawing code from the AP stream generation code in
CPWL_Utils and places it in CFX_RenderDevice.
Change-Id: I5335fc38368740ba3ddc676ee856201a358979fc
Reviewed-on: https://pdfium-review.googlesource.com/7715
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
This CL adds a method to CFX_FloatRect to get a new deflated rectangle
from a given rectangle.
Change-Id: I781222257c82baf94d5f77deede52fbe4e97c701
Reviewed-on: https://pdfium-review.googlesource.com/7850
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
This CL removes duplicate huffman_assign_code()s and changes some
return values and members to std::vector.
Change-Id: I47a1e0e2e88ff54ec799c97e92ec9ff5ca87c6c7
Reviewed-on: https://pdfium-review.googlesource.com/7910
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
In this CL, CPDF_MeshStream::ReadVertexRow returns a vector. The vector
size is not allocated in advance to prevent OOM attacks, since the size
is given as an input to the PDF.
Bug: chromium:735248
Change-Id: I3e2b020896f24715af5dfd9aa18768e6d64d6f76
Reviewed-on: https://pdfium-review.googlesource.com/7950
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
Test cases that are commented out are failing with our current
implementation.
Change-Id: I9f80003af5a5d182f53cc655454aec44397d278b
Reviewed-on: https://pdfium-review.googlesource.com/7890
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
Change-Id: I874c537454bda024224a01c905b7ba01a90a6970
Reviewed-on: https://pdfium-review.googlesource.com/7732
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
Updated pdfium_test's WriteAnnot() (corresponding to the --annot flag)
to output more annotation info using the new APIs.
Also fixed some nits in the annotation API code.
Bug=pdfium:737
Change-Id: I3f40e83279ec82529f732eb94f309ab7d4992d3c
Reviewed-on: https://pdfium-review.googlesource.com/7791
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Jane Liu <janeliulwq@google.com>
|
|
This CL makes HDPATS in CJBig2_PatternDict be a vector of unique_ptr.
Change-Id: Ib23aed6323d4a988b2eedc4bfe95f2098d32c188
Reviewed-on: https://pdfium-review.googlesource.com/7871
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|
|
These files were originally renamed thinking they'd move with the
colour class up to core/. It was decided that CPWL_Color was a better
core colour class the the xfa colour so these are being renamed back to
XFA based names to make it clear where they live.
Change-Id: Ie89f2306be0609add29bd445e719567e7b439211
Reviewed-on: https://pdfium-review.googlesource.com/7754
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
|
|
This CL allows TestSaved to open password-protected and linearized
documents properly. It also adds a test with one such document.
BUG= pdfium:787
Change-Id: Ie0da7f290711505fb208794afdc737c36e84dd3c
Reviewed-on: https://pdfium-review.googlesource.com/7034
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
|
|
Missing config will cause the pdfium_diff build to fail, since it will
not be able to resolve the coverage instrument calls when linking.
Change-Id: I1940432fe7176cad5da80de5e23aad9be188eb69
Reviewed-on: https://pdfium-review.googlesource.com/7870
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
|
|
This CL changes usage of PartitionAlloc in fx_memory to allow null
return value for methods used by external C libraries.
Change-Id: I8e2b5dcfb37e30370606afb9a71a7a1d3a28c097
Reviewed-on: https://pdfium-review.googlesource.com/7770
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
|