PDF: Fix uninit memory access in PDFiumEngine.

pdf/pdfium/pdfium_engine.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/pdfium/pdfium_engine.h"
 
 #include <math.h>
 
 #include "base/json/json_writer.h"
 #include "base/logging.h"
@@ skipping 543 matching lines @@
 PDFiumEngine::PDFiumEngine(PDFEngine::Client* client)
     : client_(client),
       current_zoom_(1.0),
       current_rotation_(0),
       doc_loader_(this),
       password_tries_remaining_(0),
       doc_(NULL),
       form_(NULL),
       defer_page_unload_(false),
       selecting_(false),
+      mouse_down_state_(PDFiumPage::NONSELECTABLE_AREA,
+                        PDFiumPage::LinkTarget()),
       next_page_to_search_(-1),
       last_page_to_search_(-1),
       last_character_index_to_search_(-1),
       current_find_index_(-1),
       permissions_(0),
       fpdf_availability_(NULL),
       next_timer_id_(0),
       last_page_mouse_down_(-1),
       first_visible_page_(-1),
       most_visible_page_(-1),
@@ skipping 741 matching lines @@
     return false;
 
   SelectionChangeInvalidator selection_invalidator(this);
   selection_.clear();
 
   int page_index = -1;
   int char_index = -1;
   PDFiumPage::LinkTarget target;
   PDFiumPage::Area area = GetCharIndex(event, &page_index,
                                        &char_index, &target);
-  mouse_down_state_ = MouseDownState(area, target);
+  mouse_down_state_.Set(area, target);
 
   // Decide whether to open link or not based on user action in mouse up and
   // mouse move events.
   if (area == PDFiumPage::WEBLINK_AREA)
     return true;
 
   if (area == PDFiumPage::DOCLINK_AREA) {
     client_->ScrollToPage(target.page);
     client_->FormTextFieldFocusChange(false);
     return true;

[raymes, 2014/09/15 00:02:59]

optional: I guess you might as well move this down into OnMouseUp as well?

[Lei Zhang, 2014/09/15 15:26:09]

Maybe in a separate CL.

[Lei Zhang, 2017/05/10 01:02:40]

I forgot about this, but I was revisiting this CL, noticed this and filed
https://bugs.chromium.org/p/chromium/issues/detail?id=720179

   }
 
   if (page_index != -1) {
     last_page_mouse_down_ = page_index;
     double page_x, page_y;
     pp::Point point = event.GetPosition();
     DeviceToPage(page_index, point.x(), point.y(), &page_x, &page_y);
 
     FORM_OnLButtonDown(form_, pages_[page_index]->GetPage(), 0, page_x, page_y);
     int control = FPDPage_HasFormFieldAtPoint(
@@ skipping 57 matching lines @@
   if (event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_LEFT)
     return false;
 
   int page_index = -1;
   int char_index = -1;
   PDFiumPage::LinkTarget target;
   PDFiumPage::Area area =
       GetCharIndex(event, &page_index, &char_index, &target);
 
   // Open link on mouse up for same link for which mouse down happened earlier.
-  if (mouse_down_state_ == MouseDownState(area, target)) {
+  if (mouse_down_state_.Matches(area, target)) {
     if (area == PDFiumPage::WEBLINK_AREA) {
       bool open_in_new_tab = !!(event.GetModifiers() & kDefaultKeyModifier);
       client_->NavigateTo(target.url, open_in_new_tab);
       client_->FormTextFieldFocusChange(false);
       return true;
     }
   }
 
   if (page_index != -1) {
     double page_x, page_y;
@@ skipping 12 matching lines @@
 
 bool PDFiumEngine::OnMouseMove(const pp::MouseInputEvent& event) {
   int page_index = -1;
   int char_index = -1;
   PDFiumPage::LinkTarget target;
   PDFiumPage::Area area =
       GetCharIndex(event, &page_index, &char_index, &target);
 
   // Clear |mouse_down_state_| if mouse moves away from where the mouse down
   // happened.
-  if (mouse_down_state_ != MouseDownState(area, target))
-    mouse_down_state_ = MouseDownState();
+  if (!mouse_down_state_.Matches(area, target))
+    mouse_down_state_.Reset();
 
   if (!selecting_) {
     PP_CursorType_Dev cursor;
     switch (area) {
       case PDFiumPage::TEXT_AREA:
         cursor = PP_CURSORTYPE_IBEAM;
         break;
       case PDFiumPage::WEBLINK_AREA:
       case PDFiumPage::DOCLINK_AREA:
         cursor = PP_CURSORTYPE_HAND;
@@ skipping 1291 matching lines @@
 
     std::vector<pp::Rect> selection_rects =
         engine_->selection_[i].GetScreenRects(
             visible_rect.point(),
             engine_->current_zoom_,
             engine_->current_rotation_);
     rects->insert(rects->end(), selection_rects.begin(), selection_rects.end());
   }
 }
 
+PDFiumEngine::MouseDownState::MouseDownState(
+    const PDFiumPage::Area& area,
+    const PDFiumPage::LinkTarget& target)
+    : area_(area), target_(target) {
+}
+
+PDFiumEngine::MouseDownState::~MouseDownState() {
+}
+
+void PDFiumEngine::MouseDownState::Set(const PDFiumPage::Area& area,
+                                       const PDFiumPage::LinkTarget& target) {
+  area_ = area;
+  target_ = target;
+}
+
+void PDFiumEngine::MouseDownState::Reset() {
+  area_ = PDFiumPage::NONSELECTABLE_AREA;
+  target_ = PDFiumPage::LinkTarget();
+}
+
+bool PDFiumEngine::MouseDownState::Matches(
+    const PDFiumPage::Area& area,
+    const PDFiumPage::LinkTarget& target) const {
+  if (area_ == area) {
+    if (area == PDFiumPage::WEBLINK_AREA)
+      return target_.url == target.url;
+    if (area == PDFiumPage::DOCLINK_AREA)
+      return target_.page == target.page;
+    return true;
+  }
+  return false;
+}
+
 void PDFiumEngine::DeviceToPage(int page_index,
                                 float device_x,
                                 float device_y,
                                 double* page_x,
                                 double* page_y) {
   *page_x = *page_y = 0;
   int temp_x = static_cast<int>((device_x + position_.x())/ current_zoom_ -
       pages_[page_index]->rect().x());
   int temp_y = static_cast<int>((device_y + position_.y())/ current_zoom_ -
       pages_[page_index]->rect().y());
@@ skipping 714 matching lines @@
     double* height) {
   FPDF_DOCUMENT doc = FPDF_LoadMemDocument(pdf_buffer, pdf_buffer_size, NULL);
   if (!doc)
     return false;
   bool success = FPDF_GetPageSizeByIndex(doc, page_number, width, height) != 0;
   FPDF_CloseDocument(doc);
   return success;
 }
 
 }  // namespace chrome_pdf