Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(255)

Issues Search
    My Issues | Starred     Open | Closed | All

Issue 1566903002: XFA: Change the destruction order inside CPDFXFA_Document to avoid UAFs. (Closed)

Created:
4 years, 11 months ago by Lei Zhang
Modified:
4 years, 11 months ago
Reviewers:
Tom Sepez, jun_fang
CC:
pdfium-reviews_googlegroups.com
Base URL:
https://pdfium.googlesource.com/pdfium.git@xfa
Target Ref:
refs/heads/xfa
Visibility:
Public.

Description

XFA: Change the destruction order inside CPDFXFA_Document to avoid UAFs. R=jun_fang@foxitsoftware.com, tsepez@chromium.org Committed: https://pdfium.googlesource.com/pdfium/+/20e25f2d6cbe4e9955a6e7c445749d5492548d76

Patch Set 1 #

Patch Set 2 : actually flip the destruction order #

Total comments: 6

Patch Set 3 : nits #

Unified diffs Side-by-side diffs Delta from patch set Stats (+9 lines, -26 lines) Patch
M fpdfsdk/include/fpdfxfa/fpdfxfa_doc.h View 1 chunk +0 lines, -1 line 0 comments Download
M fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp View 1 2 4 chunks +9 lines, -25 lines 0 comments Download

Messages

Total messages: 8 (2 generated)
Lei Zhang
The UAF is in forms accessing CPDF_Dictionary objects that are owned by CPDF_Document, and have ...
4 years, 11 months ago (2016-01-07 00:41:10 UTC) #2
Tom Sepez
lgtm
4 years, 11 months ago (2016-01-07 01:01:13 UTC) #3
jun_fang
https://codereview.chromium.org/1566903002/diff/20001/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp File fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp (right): https://codereview.chromium.org/1566903002/diff/20001/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp#newcode50 fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp:50: m_pJSContext = nullptr; Nit: Do we need to set ...
4 years, 11 months ago (2016-01-07 04:30:47 UTC) #4
jun_fang
On 2016/01/07 04:30:47, jun_fang wrote: > https://codereview.chromium.org/1566903002/diff/20001/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp > File fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp (right): > > https://codereview.chromium.org/1566903002/diff/20001/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp#newcode50 > ...
4 years, 11 months ago (2016-01-07 04:31:08 UTC) #5
Lei Zhang
https://codereview.chromium.org/1566903002/diff/20001/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp File fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp (right): https://codereview.chromium.org/1566903002/diff/20001/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp#newcode50 fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp:50: m_pJSContext = nullptr; On 2016/01/07 04:30:47, jun_fang wrote: > ...
4 years, 11 months ago (2016-01-07 06:54:26 UTC) #6
Lei Zhang
4 years, 11 months ago (2016-01-07 06:54:56 UTC) #8
Message was sent while issue was closed. 
Committed patchset #3 (id:40001) manually as
20e25f2d6cbe4e9955a6e7c445749d5492548d76 (tree was closed).

Powered by Google App Engine
This is Rietveld 408576698