VULNERABILITY DETAILS

This bug is present in JSPropSetter method in fxjs/js_define.h file.
I think JSMethod and JSPropGetter methods in fxjs/js_define.h also has the same bug.
But I could not prepare a test case for those methods.

Below is a code section from JSPropSetter method.

template <class C, CJS_Return (C::*M)(CJS_Runtime*)>
void JSPropGetter(const char* prop_name_string,
                  const char* class_name_string,
                  v8::Local<v8::String> property,
                  const v8::PropertyCallbackInfo<v8::Value>& info) {
  CJS_Object* pJSObj = CFXJS_Engine::GetObjectPrivate(info.Holder());
  .....
  C* pObj = static_cast<C*>(pJSObj);
  CJS_Return result = (pObj->*M)(pRuntime);
  ......
}

Above method uses CFXJS_Engine::GetObjectPrivate method to get private CJS_Object from javascript object.
Then try to cast CJS_Object to the subclass type of "C"(see template above method signature).
But does not check wether the actual type of CJS_Object matches type "C".

This is the code of CFXJS_Engine::GetObjectPrivate method.

CJS_Object* CFXJS_Engine::GetObjectPrivate(v8::Local<v8::Object> pObj) {
  CFXJS_PerObjectData* pData = CFXJS_PerObjectData::GetFromObject(pObj);
  if (!pData && !pObj.IsEmpty()) {
    // It could be a global proxy object.

    v8::Local<v8::Value> v = pObj->GetPrototype(); 
     /* Note:  Prototype can be changed with  Object.setPrototypeOf */

    if (v->IsObject()) {
      pData = CFXJS_PerObjectData::GetFromObject(
          v->ToObject(v8::Isolate::GetCurrent()->GetCurrentContext())
              .ToLocalChecked());
    }
  }
  return pData ? pData->m_pPrivate.get() : nullptr;
}  

Setting the prototype of javascript object to a diffent type of object makes CFXJS_Engine::GetObjectPrivate method to return
incorrect type of CJS_Object to JSPropGetter method.
ex. a = new app.constructor;
    Object.setPrototypeOf(a,global);

VERSION
Chrome Version: [67.0.3396.99] + [stable]
                [69.0.3487.0] + [Trunk build]
Operating System: [Windows 10 , Ubuntu 16.04]

REPRODUCTION CASE
1. Open attached cast.pdf with chrome.
   PDF plugin process will crash.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [PDF plugin process]
Crash State: [Address Sanitizer output]

This is the address sanitizer output produced by test case. 
But it does not show the actual stacktrace for bad cast bug.

==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000019701 at pc 0x55d70318592e bp 0x7ffcf4828700 sp 0x7ffcf48286f8
READ of size 8 at 0x608000019701 thread T0 (chrome)
    #0 0x55d70318592d in __insert_node_at /chromium/src/out/asan/../../buildtools/third_party/libc++/trunk/include/__tree:2112:25
    #1 0x55d70318592d in std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<fxcrt::ByteString, std::__1::unique_ptr<CJS_Global::JSGlobalData, std::__1::default_delete<CJS_Global::JSGlobalData> > >, std::__1::__tree_node<std::__1::__value_type<fxcrt::ByteString, std::__1::unique_ptr<CJS_Global::JSGlobalData, std::__1::default_delete<CJS_Global::JSGlobalData> > >, void*>*, long>, bool> std::__1::__tree<std::__1::__value_type<fxcrt::ByteString, std::__1::unique_ptr<CJS_Global::JSGlobalData, std::__1::default_delete<CJS_Global::JSGlobalData> > >, std::__1::__map_value_compare<fxcrt::ByteString, std::__1::__value_type<fxcrt::ByteString, std::__1::unique_ptr<CJS_Global::JSGlobalData, std::__1::default_delete<CJS_Global::JSGlobalData> > >, std::__1::less<fxcrt::ByteString>, true>, std::__1::allocator<std::__1::__value_type<fxcrt::ByteString, std::__1::unique_ptr<CJS_Global::JSGlobalData, std::__1::default_delete<CJS_Global::JSGlobalData> > > > >::__emplace_unique_key_args<fxcrt::ByteString, std::__1::piecewise_construct_t const&, std::__1::tuple<fxcrt::ByteString const&>, std::__1::tuple<> >(fxcrt::ByteString const&, std::__1::piecewise_construct_t const&&&, std::__1::tuple<fxcrt::ByteString const&>&&, std::__1::tuple<>&&) /chromium/src/out/asan/../../buildtools/third_party/libc++/trunk/include/__tree:2141:0
    #2 0x55d7031843da in operator[] /chromium/src/out/asan/../../buildtools/third_party/libc++/trunk/include/map:1319:20
    #3 0x55d7031843da in CJS_Global::SetGlobalVariables(fxcrt::ByteString const&, JS_GlobalDataType, double, bool, fxcrt::ByteString const&, v8::Local<v8::Object>, bool) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_global.cpp:563:0
    #4 0x55d703183a99 in CJS_Global::SetProperty(CJS_Runtime*, wchar_t const*, v8::Local<v8::Value>) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_global.cpp:278:12
    #5 0x55d703180b89 in JSSpecialPropPut<CJS_Global> /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_global.cpp:86:50
    #6 0x55d703180b89 in CJS_Global::putprop_static(v8::Local<v8::Name>, v8::Local<v8::Value>, v8::PropertyCallbackInfo<v8::Value> const&) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_global.cpp:170:0
    #7 0x55d6f1ae97cf in v8::internal::PropertyCallbackArguments::CallNamedSetter(v8::internal::Handle<v8::internal::InterceptorInfo>, v8::internal::Handle<v8::internal::Name>, v8::internal::Handle<v8::internal::Object>) /chromium/src/out/asan/../../v8/src/api-arguments-inl.h:168:3
    #8 0x55d6f1cc54c0 in v8::internal::(anonymous namespace)::SetPropertyWithInterceptorInternal(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::InterceptorInfo>, v8::internal::ShouldThrow, v8::internal::Handle<v8::internal::Object>) /chromium/src/out/asan/../../v8/src/objects.cc:1845:20
    #9 0x55d6f1cf2bd6 in SetPropertyWithInterceptor /chromium/src/out/asan/../../v8/src/objects.cc:4884:10
    #10 0x55d6f1cf2bd6 in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::LanguageMode, v8::internal::Object::StoreFromKeyed, bool*) /chromium/src/out/asan/../../v8/src/objects.cc:4931:0
    #11 0x55d6f1cf279c in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::LanguageMode, v8::internal::Object::StoreFromKeyed) /chromium/src/out/asan/../../v8/src/objects.cc:5014:9
    #12 0x55d6f1ac166a in v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>, v8::internal::Handle<v8::internal::Object>, v8::internal::Object::StoreFromKeyed) /chromium/src/out/asan/../../v8/src/ic/ic.cc:1429:3
    #13 0x55d6f1ad319c in __RT_impl_Runtime_StoreIC_Miss /chromium/src/out/asan/../../v8/src/ic/ic.cc:2283:5
    #14 0x55d6f1ad319c in v8::internal::Runtime_StoreIC_Miss(int, v8::internal::Object**, v8::internal::Isolate*) /chromium/src/out/asan/../../v8/src/ic/ic.cc:2269:0
    #15 0x55d6f27b49cd in v8_Default_embedded_blob_ embedded.cc:?
    #16 0x55d6f27b49cd in ?? ??:0
    #11 0x7ec7f408675b  (<unknown module>)
    #12 0x7ec7f40086a5  (<unknown module>)
    #17 0x55d6f2728502 in v8_Default_embedded_blob_ embedded.cc:?
    #18 0x55d6f2728502 in ?? ??:0
    #14 0x7ec7f40041c0  (<unknown module>)
    #19 0x55d6f188e146 in Call /chromium/src/out/asan/../../v8/src/simulator.h:113:12
    #20 0x55d6f188e146 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::Object>, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) /chromium/src/out/asan/../../v8/src/execution.cc:155:0
    #21 0x55d6f188d993 in CallInternal /chromium/src/out/asan/../../v8/src/execution.cc:191:10
    #22 0x55d6f188d993 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) /chromium/src/out/asan/../../v8/src/execution.cc:202:0
    #23 0x55d6f0ea8f9c in v8::Script::Run(v8::Local<v8::Context>) /chromium/src/out/asan/../../v8/src/api.cc:2209:7
    #24 0x55d7031752cd in CFXJS_Engine::Execute(fxcrt::WideString const&) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cfxjs_engine.cpp:532:25
    #25 0x55d70317c221 in CJS_Runtime::ExecuteScript(fxcrt::WideString const&) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_runtime.cpp:182:10
    #26 0x55d70320fcc7 in CJS_EventContext::RunScript(fxcrt::WideString const&) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_event_context.cpp:53:23
    #27 0x55d702c7c8d6 in RunScript /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_actionhandler.cpp:546:13
    #28 0x55d702c7c8d6 in CPDFSDK_ActionHandler::RunDocumentOpenJavaScript(CPDFSDK_FormFillEnvironment*, fxcrt::WideString const&, fxcrt::WideString const&) /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_actionhandler.cpp:455:0
    #29 0x55d702c7c58a in CPDFSDK_ActionHandler::DoAction_JavaScript(CPDF_Action const&, fxcrt::WideString, CPDFSDK_FormFillEnvironment*) /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_actionhandler.cpp:37:7
    #30 0x55d702c853ae in CPDFSDK_FormFillEnvironment::ProcJavascriptFun() /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:563:25
    #31 0x55d702bea77c in chrome_pdf::PDFiumEngine::FinishLoadingDocument() /chromium/src/out/asan/../../pdf/pdfium/pdfium_engine.cc:1031:3
    #32 0x55d702c01d8c in chrome_pdf::PDFiumEngine::ContinueLoadingDocument(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) /chromium/src/out/asan/../../pdf/pdfium/pdfium_engine.cc:2619:5
    #33 0x55d702be912b in chrome_pdf::PDFiumEngine::LoadDocument() /chromium/src/out/asan/../../pdf/pdfium/pdfium_engine.cc:2532:5
    #34 0x55d702c11bec in chrome_pdf::DocumentLoaderImpl::DidRead(int) /chromium/src/out/asan/../../pdf/document_loader_impl.cc:0:7
    #35 0x55d702c12acb in operator() /chromium/src/out/asan/../../ppapi/utility/completion_callback_factory.h:6......

0x608000019701 is located 31 bytes to the left of 96-byte region [0x608000019720,0x608000019780)
allocated by thread T0 (chrome) here:
    #0 0x55d6ec253412 in operator new(unsigned long) _asan_rtl_:3
    #1 0x55d703181740 in MakeUnique<CJS_Global, v8::Local<v8::Object> &, CJS_Runtime *> /chromium/src/out/asan/../../third_party/pdfium/third_party/base/ptr_util.h:56:29
    #2 0x55d703181740 in void JSConstructor<CJS_Global>(CFXJS_Engine*, v8::Local<v8::Object>) /chromium/src/out/asan/../../third_party/pdfium/fxjs/js_define.h:54:0
    #3 0x55d7031744e2 in operator() /chromium/src/out/asan/../../buildtools/third_party/libc++/trunk/include/functional:1913:12
    #4 0x55d7031744e2 in CFXJS_Engine::NewFXJSBoundObject(int, bool) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cfxjs_engine.cpp:561:0
    #5 0x55d703173af9 in CFXJS_Engine::InitializeEngine() /chromium/src/out/asan/../../third_party/pdfium/fxjs/cfxjs_engine.cpp:468:35
    #6 0x55d70317ab0d in CJS_Runtime::CJS_Runtime(CPDFSDK_FormFillEnvironment*) /chromium/src/out/asan/../../third_party/pdfium/fxjs/cjs_runtime.cpp:77:3
    #7 0x55d70316e33d in MakeUnique<CJS_Runtime, CPDFSDK_FormFillEnvironment *&> /chromium/src/out/asan/../../third_party/pdfium/third_party/base/ptr_util.h:56:33
    #8 0x55d70316e33d in IJS_Runtime::Create(CPDFSDK_FormFillEnvironment*) /chromium/src/out/asan/../../third_party/pdfium/fxjs/ijs_runtime.cpp:35:0
    #9 0x55d702c8368e in CPDFSDK_FormFillEnvironment::GetIJSRuntime() /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:212:21
    #10 0x55d702c7c7f2 in RunScript /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_actionhandler.cpp:544:58
    #11 0x55d702c7c7f2 in CPDFSDK_ActionHandler::RunDocumentOpenJavaScript(CPDFSDK_FormFillEnvironment*, fxcrt::WideString const&, fxcrt::WideString const&) /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_actionhandler.cpp:455:0
    #12 0x55d702c7c58a in CPDFSDK_ActionHandler::DoAction_JavaScript(CPDF_Action const&, fxcrt::WideString, CPDFSDK_FormFillEnvironment*) /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_actionhandler.cpp:37:7
    #13 0x55d702c853ae in CPDFSDK_FormFillEnvironment::ProcJavascriptFun() /chromium/src/out/asan/../../third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:563:25
    #14 0x55d702bea77c in chrome_pdf::PDFiumEngine::FinishLoadingDocument() /chromium/src/out/asan/../../pdf/pdfium/pdfium_engine.cc:1031:3
    #15 0x55d702c01d8c in chrome_pdf::PDFiumEngine::ContinueLoadingDocument(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) /chromium/src/out/asan/../../pdf/pdfium/pdfium_engine.cc:2619:5
    #16 0x55d702be912b in chrome_pdf::PDFiumEngine::LoadDocument() /chromium/src/out/asan/../../pdf/pdfium/pdfium_engine.cc:2532:5
    #17 0x55d702c11bec in chrome_pdf::DocumentLoaderImpl::DidRead(int) /chromium/src/out/asan/../../pdf/document_loader_impl.cc:0:7
    #18 0x55d702c12acb in operator() 
.....
 

Deleted: cast.pdf 2.0 KB

cast.pdf 2.0 KB Download