diff options
| author | Tom Sepez <tsepez@chromium.org> | 2023-03-07 22:42:23 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2023-04-03 15:24:52 +0000 |
| commit | d7f9cbcab5b1ecfe64ae88dc799dfafce298ed61 (patch) | |
| tree | 02820e193635c96e769845c30cf80cd19db32b21 /chromium/third_party | |
| parent | bf64be793c0b5e3a838ea171365ad4287670f1c4 (diff) | |
| download | qtwebengine-chromium-d7f9cbcab5b1ecfe64ae88dc799dfafce298ed61.tar.gz | |
[Backport] CVE-2023-1530: Use after free in PDF (2/2)
Cherry-pick of patch originally reviewed on
https://pdfium-review.googlesource.com/c/pdfium/+/104511:
More tightly validate XML names in CXFA_FFDocView::GetWidgetByName()
Widget names must conform to XML name rules.
-- Beef up tests while at it.
Fixed: chromium:1419831
Change-Id: Id36b4a7b3d84aa0b74d54c91eed2f1a11da8298f
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/104511
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468504
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
Diffstat (limited to 'chromium/third_party')
| -rw-r--r-- | chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp index 480bc72b97c..bb8fa982c3f 100644 --- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp +++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp @@ -11,6 +11,7 @@ #include "core/fxcrt/fx_extension.h" #include "core/fxcrt/stl_util.h" +#include "core/fxcrt/xml/cfx_xmlparser.h" #include "fxjs/gc/container_trace.h" #include "fxjs/xfa/cfxjse_engine.h" #include "fxjs/xfa/cjx_object.h" @@ -43,6 +44,21 @@ #include "xfa/fxfa/parser/cxfa_validate.h" #include "xfa/fxfa/parser/xfa_utils.h" +namespace { + +bool IsValidXMLNameString(const WideString& str) { + bool first = true; + for (const auto ch : str) { + if (!CFX_XMLParser::IsXMLNameChar(ch, first)) { + return false; + } + first = false; + } + return true; +} + +} // namespace + const XFA_AttributeValue kXFAEventActivity[] = { XFA_AttributeValue::Click, XFA_AttributeValue::Change, XFA_AttributeValue::DocClose, XFA_AttributeValue::DocReady, @@ -445,6 +461,9 @@ XFA_EventError CXFA_FFDocView::ExecEventActivityByDeepFirst( CXFA_FFWidget* CXFA_FFDocView::GetWidgetByName(const WideString& wsName, CXFA_FFWidget* pRefWidget) { + if (!IsValidXMLNameString(wsName)) { + return nullptr; + } CFXJSE_Engine* pScriptContext = m_pDoc->GetXFADoc()->GetScriptContext(); CXFA_Node* pRefNode = nullptr; if (pRefWidget) { |