From 0c99829cc38ed2191a71d16c34278e391411aa1b Mon Sep 17 00:00:00 2001 From: Dan Sinclair Date: Thu, 13 Jul 2017 09:58:52 -0400 Subject: Fix invalid write for util.printf This CL fixes and invalid WRITE triggered by calling util.printf. We need to verify that the integer format will be less then 260 characters. Bug: chromium:740166 Change-Id: I1c9047101780582da5f39088568727e2c8b4c2d2 Reviewed-on: https://pdfium-review.googlesource.com/7630 Reviewed-by: Tom Sepez Commit-Queue: dsinclair --- testing/resources/javascript/bug_740166.in | 58 ++++++++++++++++++++++ .../resources/javascript/bug_740166_expected.txt | 0 2 files changed, 58 insertions(+) create mode 100644 testing/resources/javascript/bug_740166.in create mode 100644 testing/resources/javascript/bug_740166_expected.txt (limited to 'testing/resources/javascript') diff --git a/testing/resources/javascript/bug_740166.in b/testing/resources/javascript/bug_740166.in new file mode 100644 index 0000000000..62bc912e31 --- /dev/null +++ b/testing/resources/javascript/bug_740166.in @@ -0,0 +1,58 @@ +{{header}} +{{object 1 0}} << + /Type /Catalog + /Pages 2 0 R + /AcroForm 4 0 R + /OpenAction 10 0 R +>> +endobj +{{object 2 0}} << + /Type /Pages + /Count 1 + /Kids [ + 3 0 R + ] +>> +endobj +% Page number 0. +{{object 3 0}} << + /Type /Page + /Parent 2 0 R + /Resources << + /Font <> + >> + /Contents [21 0 R] + /MediaBox [0 0 612 792] +>> +% Forms +{{object 4 0}} << + /Fields [5 0 R] +>> +% Field +{{object 5 0}} << + /FT /Tx + /T (MyField) + /Type /Annot + /Subtype /Widget + /Rect [100 200 150 250] +>> +% OpenAction action +{{object 10 0}} << + /Type /Action + /S /JavaScript + /JS 11 0 R +>> +endobj +% JS program to exexute +{{object 11 0}} << +>> +stream +app.alert("Value " + util.printf("= %0.769x", 1)); +endstream +endobj +{{xref}} +trailer << + /Root 1 0 R +>> +{{startxref}} +%%EOF diff --git a/testing/resources/javascript/bug_740166_expected.txt b/testing/resources/javascript/bug_740166_expected.txt new file mode 100644 index 0000000000..e69de29bb2 -- cgit v1.2.3