New issue
Advanced search Search tips

Issue 733170 link

Starred by 0 users
Status: Duplicate
Merged: issue 729041
Owner: ----
Closed: Jun 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug-Security



Sign in to add a comment

UAF in CPWL_ComboBox::~CPWL_ComboBox()

Reported by manhluat...@gmail.com, Jun 14 2017 
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Steps to reproduce the problem:
1. Download chromium with asan built at https://commondatastorage.googleapis.com/chromium-browser-asan/index.html
2. Run poc.pdf
3. ASAN crashes

What is the expected behavior?

What went wrong?
Tested on Chromium Mac ASAN version 60.0.3102.0.

Poc is generated by fixup script.

Did this work before? N/A 

Chrome version: 58.0.3029.110  Channel: n/a
OS Version: OS X 10.12.5
Flash Version:
crash1
76.9 KB View Download

Comment 1 Deleted

Comment 2 Deleted

Comment 3 by manhluat...@gmail.com, Jun 14 2017 

1. Open |test.pdf| on chromium asan.
2. ASAN crashes

Tested on MAC/Linux as well.
test.in
3.5 KB Download
test.pdf
4.3 KB Download

Comment 4 by manhluat...@gmail.com, Jun 14 2017 

There are 3 pages.

Page 0 includes |MyField3| Combobox.

Document JS Action:
    var f = this.getField("MyField3");
    f.setFocus();
    this.pageNum=2;

Closing Page 0 AAction:
  this.getField('MyField3').value = "test 2";
  this.pageNum=2;

Comment 5 by manhluat...@gmail.com, Jun 14 2017 

This is another ASAN crashes for new PoC
asan_2
38.8 KB View Download

Comment 7 by est...@chromium.org, Jun 14 2017

Components: Internals>Plugins>PDF
Mergedinto: 729041
Status: Duplicate (was: Unconfirmed)
PDFium folks: I'm not sure if this is an exact duplicate, please feel free to adjust.

Comment 8 by thestig@chromium.org, Jun 15 2017 

It's the same and fairly harmless. If you go back to https://pdfium.googlesource.com/pdfium/+/2eddb665763f3e089d4c210d2a011d112683f3ea for instance, you'll see there wasn't an ASAN error in the first place before we added CFX_UnownedPtr.
Project Member

Comment 9 by sheriffbot@chromium.org, Sep 21 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment