Tested on:

OS: Ubuntu 14.04

pdfium_test: linux-release-asan-symbolized-linux-release-393191

Note1: I found this issue when minimizing repro-file from https://cluster-fuzz.appspot.com/testcase?key=5080174055391232 I couldn't reproduce the wild-pointer-read from the CF report with an ASAN build. 

Note2: This issue shows up as an UAF only with pdfium_test, on chromium it shows up as a crash with a similar stack but as a null-pointer instead of an UAF.

Note3: Second repro-file is for a heap-buffer-overflow READ size 4, in pdfium_test. My minimizer caught it while minimizing the repro-file. Stack is so similar that I'm guessing it is the same root cause. In Chromium the repro-file causes null-pointer crash.

ASAN-trace:

Rendering PDF file /results/heap-use-after-free-8d2-641-d6d.pdf.
=================================================================
==4189==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500017e968 at pc 0x0000009328d3 bp 0x7ffe1a67de10 sp 0x7ffe1a67de08
READ of size 8 at 0x62500017e968 thread T0
    #0 0x9328d2 in CFX_StringDataTemplate<wchar_t>::Retain() /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/core/fxcrt/cfx_string_data_template.h:53
    #1 0xaf2641 in (anonymous namespace)::StrTrim(CFX_WideString const&) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/fpdfsdk/javascript/PublicMethods.cpp:73
    #2 0xaf7d6d in AFNumber_Keystroke /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/fpdfsdk/javascript/PublicMethods.cpp:906 (discriminator 1)
    #3 0xb00472 in JSGlobalFunc<&CJS_PublicMethods::AFNumber_Keystroke> /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/fpdfsdk/javascript/JS_Define.h:454
    #4 0x17cbb5c in Call /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/api-arguments.cc:15
    #5 0xbc06ac in HandleApiCallHelper /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:4620 (discriminator 1)
    #6 0xc30646 in Builtin_Impl_HandleApiCall /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:4638 (discriminator 5)
    #7 0xbcce34 in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:4635 (discriminator 6)
.
.
.
0x62500017e968 is located 104 bytes inside of 8192-byte region [0x62500017e900,0x625000180900)
freed by thread T0 here:
    #0 0x4b651b in __interceptor_free ??:?
    #1 0x1dc2864 in v8::base::AccountingAllocator::Free(void*, unsigned long) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/base/accounting-allocator.cc:23
    #2 0x1632421 in v8::internal::Zone::DeleteKeptSegment() /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/zone.cc:195
    #3 0xec7877 in void v8::internal::HGraph::Run<v8::internal::HRepresentationChangesPhase>() /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/crankshaft/hydrogen.h:477
    #4 0xea65b3 in v8::internal::HGraph::Optimize(v8::internal::BailoutReason*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/crankshaft/hydrogen.cc:4686
    #5 0xc9a06c in v8::internal::OptimizeGraph(v8::internal::HGraph*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/code-stubs-hydrogen.cc:24
    #6 0xc820ea in v8::internal::Handle<v8::internal::Code> v8::internal::DoGenerateCode<v8::internal::LoadFieldStub>(v8::internal::LoadFieldStub*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/code-stubs-hydrogen.cc:290 (discriminator 2)
.
.
.

ASAN-trace:(chromium)

==4681==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55a5d35e0d2a bp 0x7ffd8f439410 sp 0x7ffd8f439400 T0)
==4681==The signal is caused by a READ memory access.
==4681==Hint: address points to the zero page.
    #0 0x55a5d35e0d29 in CFX_StringDataTemplate<wchar_t>::Retain() /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/core/fxcrt/cfx_string_data_template.h:53
    #1 0x55a5d379f4c1 in (anonymous namespace)::StrTrim(CFX_WideString const&) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/fpdfsdk/javascript/PublicMethods.cpp:73
    #2 0x55a5d37a4bed in AFNumber_Keystroke /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/fpdfsdk/javascript/PublicMethods.cpp:906 (discriminator 1)
    #3 0x55a5d37ad2f2 in JSGlobalFunc<&CJS_PublicMethods::AFNumber_Keystroke> /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/pdfium/fpdfsdk/javascript/JS_Define.h:454
    #4 0x55a5ca5ffbac in Call /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/api-arguments.cc:15
    #5 0x55a5c99ba56c in HandleApiCallHelper /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:4620 (discriminator 1)
    #6 0x55a5c9a2a506 in Builtin_Impl_HandleApiCall /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:4638 (discriminator 5)
    #7 0x55a5c99c6cf4 in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:4635 (discriminator 6)
.
.
.
 

Deleted: heap-use-after-free-8d2-641-d6d.pdf 300 bytes

heap-use-after-free-8d2-641-d6d.pdf 300 bytes Download

Deleted: heap-buffer-overflow-b19-c75-64e.pdf 1.6 KB

heap-buffer-overflow-b19-c75-64e.pdf 1.6 KB Download