Looks like the parser can switch state in the middle of parsing an entity.  when it does this, it sets m_iDataPos back to 0, but doesn't reset m_iEntityStart to -1 to indicate that we are giving up on parsing the entity in the buffer.

The second blunder is that it uses the same m_iDataPos variable to index both the
name array and the data array, and it doesn't reset the index when switching between one and the other in all cases.

The third blunder is that if we get a wild m_iDataPos passed into ReallocDataBuffer(), it doubles the size but that may not be big enough to accomodate the m_iDataPos.

ClusterFuzz has detected this issue as fixed in range 464444:464485.

Detailed report: https://clusterfuzz.com/testcase?key=4895346376572928

Fuzzer: libfuzzer_pdf_cfx_saxreader_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  CFX_ByteString::Compare
  CFX_SAXReader::ParseChar
  CFX_SAXReader::ContinueParse
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=464411:464444
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=464444:464485

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94suLpkvzDR2mN2hr3VOlXjF5kzntfsEMFUweLk_eOTiHwnoCVQwpcceFj9D7FLRpB8Id2DU0uxkgvFdCk732HvqCo6K3J43rqhVdV69GKE_-9koNtsJwtU2T9ktg6_N79cd_uOdHCZ9Sd7WtrrcYfjcgW9MAGXcPurk9b2C1SNStO1tzmPIAGXCJfR-91ZFtu1n-CxxDiN7NgdSYk66BFXUldS64HbFDiRykdaPr7sDQJN94dHXjr4ZcrnEWupr6i17Fe3LZHGGRKU83bo9yxMu-V4zPBzEpLilfPKePyIlhyC0L-vFbbHR26mNIcY3g3BwvwyTpt7N_7FupkgQS4mdw502Y1rGk-BlyjBpcOwABsRJiU?testcase_id=4895346376572928


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4895346376572928 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Still broken - not sure why CF only hits this in a narrow range - nothing changed as far as I can tell.  Thanks.

CL at https://pdfium-review.googlesource.com/4230

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

https://pdfium.googlesource.com/pdfium/+/c329d59b16b89f3533f9d309ed297938af865ae0

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot