VULNERABILITY DETAILS
An out-of-bounds-read (uninitialized-memory-read) issue was found in PDFium. Following log was produced by AddressSanitizer.

=================================================================
==9584==ERROR: AddressSanitizer: access-violation on unknown address 0xbebebec6 (pc 0x037419e3 bp 0x002deb18 sp 0x002dea60 T0)
    #0 0x37419e2 in CXFA_LayoutPageMgr::GetAvailHeight C:\pdfium\xfa\fxfa\parser\cxfa_layoutpagemgr.cpp:489
    #1 0x3714d67 in CXFA_LayoutProcessor::DoLayout C:\pdfium\xfa\fxfa\parser\cxfa_layoutprocessor.cpp:73
    #2 0x36577ba in CXFA_FFDocView::DoLayout C:\pdfium\xfa\fxfa\cxfa_ffdocview.cpp:94
    #3 0x362e0bf in CPDFXFA_Context::LoadXFADoc C:\pdfium\fpdfsdk\fpdfxfa\cpdfxfa_context.cpp:118
    #4 0x2c14ffa in FPDF_LoadXFA C:\pdfium\fpdfsdk\fpdf_view.cpp:265
    #5 0x1054269 in main C:\pdfium\samples\pdfium_test.cc:911
    #6 0x3c5b90a in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #7 0x7677343c in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd7343c)
    #8 0x77569831 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea9831)
    #9 0x77569804 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea9804)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: access-violation C:\pdfium\xfa\fxfa\parser\cxfa_layoutpagemgr.cpp:489 in CXFA_LayoutPageMgr::GetAvailHeight
==9584==ABORTING


If we compile a normal version of pdfium (with is_asan=false and is_debug=false), and enable pageheap option for pdfium_test.exe, we'll get the following information. Here the value of eax was 0xc0c0c0c0 (read from a 12-bytes heap) which indicates that the value was not initialized.

=================================================================
(2c60.499c): Access violation - code c0000005 (!!! second chance !!!)
eax=c0c0c0c0 ebx=0aed0f90 ecx=0af76fc0 edx=0031f394 esi=0af76fc0 edi=0031f3bc
eip=01b19473 esp=0031f378 ebp=0031f3a0 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
pdfium_test!CXFA_LayoutPageMgr::GetAvailHeight+0x1d:
01b19473 8b4008          mov  eax,dword ptr [eax+8] ds:002b:c0c0c0c8=????????

0:000> r eax
eax=c0c0c0c0

0:000> ub eip
pdfium_test!CXFA_LayoutPageMgr::GetAvailHeight+0x5 
    [C:\pdfium\xfa\fxfa\parser\cxfa_layoutpagemgr.cpp @ 487]:
01b1945b 83ec20          sub     esp,20h
01b1945e a1b09bf801      mov     eax,dword ptr [pdfium_test!__security_cookie (01f89bb0)]
01b19463 89ce            mov     esi,ecx
01b19465 0f57c0          xorps   xmm0,xmm0
01b19468 31e8            xor     eax,ebp
01b1946a 8945f4          mov     dword ptr [ebp-0Ch],eax
01b1946d 8b4118          mov     eax,dword ptr [ecx+18h]
01b19470 8b4008          mov     eax,dword ptr [eax+8]

0:000> dd ecx+18 L1
0af76fd8  0af78ff0

0:000> dd 0af78ff0
0af78ff0  0af78ff0 0af78ff0 c0c0c0c0 d0d0d0d0
0af79000  ???????? ???????? ???????? ????????

0:000> !heap -p -a 0af78ff0
    address 0af78ff0 found in
    _DPH_HEAP_ROOT @ 321000
    in busy allocation (  DPH_HEAP_BLOCK:  UserAddr  UserSize - VirtAddr  VirtSize)
                                 af80068:   af78ff0         c -  af78000      2000
    66248e89 verifier!AVrfDebugPageHeapAllocate+0x00000229
    7760103e ntdll!RtlDebugAllocateHeap+0x00000030
    775babe2 ntdll!RtlpAllocateHeap+0x000000c4
    775634a1 ntdll!RtlAllocateHeap+0x0000023a
    01c521e5 pdfium_test!_malloc_base+0x00000038 [minkernel\crts\ucrt\src\appcrt\heap\malloc_base.cpp @ 34]
    01c2dbea pdfium_test!operator new+0x0000001a [f:\dd\vctools\crt\vcstartup\src\heap\new_scalar.cpp @ 34]
    01b187c8 pdfium_test!CXFA_LayoutPageMgr::CXFA_LayoutPageMgr+0x00000028 [C:\pdfium\xfa\fxfa\parser\cxfa_layoutpagemgr.cpp @ 275]
    01b0f9d4 pdfium_test!CXFA_LayoutProcessor::StartLayout+0x00000086 [C:\pdfium\xfa\fxfa\parser\cxfa_layoutprocessor.cpp @ 49]
    01aed438 pdfium_test!CXFA_FFDocView::StartLayout+0x0000003c [C:\pdfium\xfa\fxfa\cxfa_ffdocview.cpp @ 74]
    01ae5057 pdfium_test!CPDFXFA_Context::LoadXFADoc+0x000000a7 [C:\pdfium\fpdfsdk\fpdfxfa\cpdfxfa_context.cpp @ 112]
    018943ee pdfium_test!FPDF_LoadXFA+0x00000022 [C:\pdfium\fpdfsdk\fpdf_view.cpp @ 265]
    012f1edb pdfium_test!main+0x00000edb [C:\pdfium\samples\pdfium_test.cc @ 911]
    01c2e61b pdfium_test!__scrt_common_main_seh+0x000000f9 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 283]
    7677343d kernel32!BaseThreadInitThunk+0x0000000e
    77569832 ntdll!__RtlUserThreadStart+0x00000070
    77569805 ntdll!_RtlUserThreadStart+0x0000001b

Here the size of the heap buffer was 12 bytes. Actually, that's ``CXFA_LayoutPageMgr::m_CurrentContainerRecordIter``。

pdfium_test.exe crashed when calling ``GetCurrentContainerRecord()`` in ``CXFA_LayoutPageMgr::GetAvailHeight()``.

```
float CXFA_LayoutPageMgr::GetAvailHeight() {
  CXFA_ContainerLayoutItem* pLayoutItem =
      GetCurrentContainerRecord()->pCurContentArea;     // ----> crashed!!!
  if (!pLayoutItem || !pLayoutItem->m_pFormNode)
    return 0.0f;

  float fAvailHeight = pLayoutItem->m_pFormNode->JSObject()
                           ->GetMeasure(XFA_Attribute::H)
                           .ToUnit(XFA_Unit::Pt);
  if (fAvailHeight >= XFA_LAYOUT_FLOAT_PERCISION)
    return fAvailHeight;
  if (m_CurrentContainerRecordIter == m_ProposedContainerRecords.begin())
    return 0.0f;
  return FLT_MAX;
}

  CXFA_ContainerRecord* /* CXFA_LayoutPageMgr:: */ GetCurrentContainerRecord() {
    return *m_CurrentContainerRecordIter;               // ----> crashed!!!
  }
```

This vulnerability is more likely exploitable since the value of ``pLayoutItem`` may be controlled by attacker.

```
  float fAvailHeight = pLayoutItem->m_pFormNode->JSObject()
                           ->GetMeasure(XFA_Attribute::H)
                           .ToUnit(XFA_Unit::Pt);
```

VERSION
Chrome Version: pdfium with XFA enabled
Operating System: Windows

REPRODUCTION CASE
A minimized proof-of-concept file will be attached.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]