Skip to content

Commit 78b0928

Browse files
tsepezmibrunin
authored andcommitted
[Backport] CVE-2021-21190: Uninitialized Use in PDFium
Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/2628044: Validate return code from FPDF_PageToDevice() A DCHECK() here isn't sufficient to prevent the use of uninitialized memory should this someday return false. Bug: 1166091 Change-Id: I4cfd28653f2e6882f227299d68605be706b75b44 Reviewed-by: K. Moon <[email protected]> Commit-Queue: Tom Sepez <[email protected]> Cr-Commit-Position: refs/heads/master@{#843247} Reviewed-by: Allan Sandfeld Jensen <[email protected]> Reviewed-by: Jüri Valdmann <[email protected]>
1 parent a84e05c commit 78b0928

File tree

1 file changed

+12
-10
lines changed

1 file changed

+12
-10
lines changed

chromium/pdf/pdfium/pdfium_page.cc

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -557,18 +557,20 @@ pp::Rect PDFiumPage::PageToScreen(const pp::Point& offset,
557557

558558
int new_left;
559559
int new_top;
560+
if (!FPDF_PageToDevice(
561+
page(), static_cast<int>(start_x), static_cast<int>(start_y),
562+
static_cast<int>(ceil(size_x)), static_cast<int>(ceil(size_y)), rotation,
563+
left, top, &new_left, &new_top)) {
564+
return pp::Rect();
565+
}
560566
int new_right;
561567
int new_bottom;
562-
FPDF_BOOL ret = FPDF_PageToDevice(
563-
page(), static_cast<int>(start_x), static_cast<int>(start_y),
564-
static_cast<int>(ceil(size_x)), static_cast<int>(ceil(size_y)), rotation,
565-
left, top, &new_left, &new_top);
566-
DCHECK(ret);
567-
ret = FPDF_PageToDevice(
568-
page(), static_cast<int>(start_x), static_cast<int>(start_y),
569-
static_cast<int>(ceil(size_x)), static_cast<int>(ceil(size_y)), rotation,
570-
right, bottom, &new_right, &new_bottom);
571-
DCHECK(ret);
568+
if (!FPDF_PageToDevice(
569+
page(), static_cast<int>(start_x), static_cast<int>(start_y),
570+
static_cast<int>(ceil(size_x)), static_cast<int>(ceil(size_y)), rotation,
571+
right, bottom, &new_right, &new_bottom)) {
572+
return pp::Rect();
573+
}
572574

573575
// If the PDF is rotated, the horizontal/vertical coordinates could be
574576
// flipped. See

0 commit comments

Comments
 (0)