From 2eef64cba5c8e08a9e625f4aba5a7fbdc8e62bad Mon Sep 17 00:00:00 2001 From: Dan Sinclair Date: Tue, 16 May 2017 11:45:23 -0400 Subject: Do not walk off end of formcalc string MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fm2js code takes a pointer to the input string and then walks along that pointer. There are currently no checks to verify we haven't walked off the end of the pointer into random memory. If this happens, we can end up allocating large chunks of memory and copying random bits. BUG=chromium:721533 Change-Id: Ia61fe96c1ff9eb9ded63cf8326b7be44986bd9e1 Reviewed-on: https://pdfium-review.googlesource.com/5550 Commit-Queue: dsinclair Reviewed-by: Nicolás Peña Reviewed-by: Lei Zhang --- xfa/fxfa/fm2js/xfa_error.h | 1 + 1 file changed, 1 insertion(+) (limited to 'xfa/fxfa/fm2js/xfa_error.h') diff --git a/xfa/fxfa/fm2js/xfa_error.h b/xfa/fxfa/fm2js/xfa_error.h index b6621da440..27ed1879cf 100644 --- a/xfa/fxfa/fm2js/xfa_error.h +++ b/xfa/fxfa/fm2js/xfa_error.h @@ -18,6 +18,7 @@ extern const wchar_t kFMErrExpectedEndIf[]; extern const wchar_t kFMErrUnexpectedExpression[]; extern const wchar_t kFMErrExpectedNonEmptyExpression[]; extern const wchar_t kFMErrLongAssignmentChain[]; +extern const wchar_t kFMErrEndOfInput[]; class CXFA_FMErrorInfo { public: -- cgit v1.2.3