Pdfium crashes when closing tab
Reported by
keve.n...@gmail.com,
Mar 23 2016
|
|||||
Issue description
UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36
Steps to reproduce the problem:
1. Open attachment
2. Make sure another tab is open with pdfium
3. Close the attachment tab.. pdfium crashes
What is the expected behavior?
What went wrong?
Crashes on stable versions, windows, linux.
ASAN report, version: asan-linux-stable-49.0.2623.87/pdfium_test :
==29415==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x0000006661cd bp 0x7ffc0debcc90 sp 0x7ffc0debcc70 T0)
#0 0x6661cc in Release third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:25:7
#1 0x6661cc in ~CPDF_Dictionary third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:582
#2 0x6661cc in CPDF_Object::Destroy() third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:42
#3 0x6660c6 in Release third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:28:3
#4 0x6660c6 in ~CPDF_Stream third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:823
#5 0x6660c6 in CPDF_Object::Destroy() third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:45
#6 0x6661d6 in Release third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:28:3
#7 0x6661d6 in ~CPDF_Dictionary third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:582
#8 0x6661d6 in CPDF_Object::Destroy() third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:42
#9 0x673690 in CPDF_IndirectObjectHolder::~CPDF_IndirectObjectHolder() third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp:1069:5
#10 0x662e70 in CPDF_Document::~CPDF_Document() third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp:100:1
#11 0x6764d8 in CPDF_Parser::CloseParser(int) third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp:165:5
#12 0x676190 in CPDF_Parser::~CPDF_Parser() third_party/pdfium/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp:126:3
#13 0x4edb1c in FPDF_CloseDocument third_party/pdfium/fpdfsdk/src/fpdfview.cpp:750:3
#14 0x4e521f in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:547:3
#15 0x4e5f25 in main third_party/pdfium/samples/pdfium_test.cc:617:7
Looks like a null dereference.
Crashed report ID:
How much crashed? Just one plugin
Is it a problem with a plugin? Yes pdfium
Did this work before? N/A
Chrome version: 49.0.2623.87 Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 21.0 r0
,
Apr 14 2016
Please upgrade to the latest stable build available and check if you still see this issue ? Looping in chromium//src/pdf/OWNERS as well.
,
Apr 15 2016
The original file i attached isn't crashing. But the bug is there, i attached another file which crashes
,
Apr 15 2016
,
Apr 15 2016
https://codereview.chromium.org/1888333002 should fix the 99.pdf case.
,
Aug 25 2016
,
Aug 25 2016
https://pdfium.googlesource.com/pdfium/+/22b176d0ee7f1dcbc7bca6e5eef65c19fa10f726 Chromium will pick up the fix later in the day.
,
Aug 25 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/99b48c2ea20be49886f6c236f4762627a6430ad8 commit 99b48c2ea20be49886f6c236f4762627a6430ad8 Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org> Date: Thu Aug 25 21:10:36 2016 Roll src/third_party/pdfium/ 43cbe9ea0..22b176d0e (2 commits). https://pdfium.googlesource.com/pdfium.git/+log/43cbe9ea0ff1..22b176d0ee7f $ git log 43cbe9ea0..22b176d0e --date=short --no-merges --format='%ad %ae %s' 2016-08-25 thestig Check for nullptrs in CPDF_Dictionary dtor. 2016-08-25 thestig Fix infinite loops in FPDF_GetFullName(). BUG= 597440 , 444446 TBR=dsinclair@chromium.org Review-Url: https://codereview.chromium.org/2283493002 Cr-Commit-Position: refs/heads/master@{#414538} [modify] https://crrev.com/99b48c2ea20be49886f6c236f4762627a6430ad8/DEPS |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by dtapu...@chromium.org
, Mar 24 2016