Commit message: None
CVE: CVE-2018-6088
CWE: CWE-20
Vulnerability description: An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

Project: Chrome

void PDFiumEngine::GetSelection(uint32_t* selection_start_page_index,
                                uint32_t* selection_start_char_index,
                                uint32_t* selection_end_page_index,
                                uint32_t* selection_end_char_index) {
  size_t len = selection_.size();
  if (len == 0) {
    *selection_start_page_index = 0;
    *selection_start_char_index = 0;
    *selection_end_page_index = 0;
    *selection_end_char_index = 0;
    return;
  }

  *selection_start_page_index = selection_[0].page_index();
  *selection_start_char_index = selection_[0].char_index();
  *selection_end_page_index = selection_[len - 1].page_index();

  if (len == 1) {
    *selection_end_char_index =
        selection_[0].char_index() + selection_[0].char_count();
  } else {
    *selection_end_char_index = selection_[len - 1].char_count();
  }
}

Project: Chrome

bool PDFiumEngine::OnMouseMove(const pp::MouseInputEvent& event) {
  int page_index = -1;
  int char_index = -1;
  int form_type = FPDF_FORMFIELD_UNKNOWN;
  PDFiumPage::LinkTarget target;
  pp::Point point = event.GetPosition();
  PDFiumPage::Area area =
      GetCharIndex(point, &page_index, &char_index, &form_type, &target);

  if (!mouse_down_state_.Matches(area, target))
    mouse_down_state_.Reset();

  if (!selecting_) {
    PP_CursorType_Dev cursor;
    switch (area) {
      case PDFiumPage::TEXT_AREA:
        cursor = PP_CURSORTYPE_IBEAM;
        break;
      case PDFiumPage::WEBLINK_AREA:
      case PDFiumPage::DOCLINK_AREA:
        cursor = PP_CURSORTYPE_HAND;
        break;
      case PDFiumPage::NONSELECTABLE_AREA:
      case PDFiumPage::FORM_TEXT_AREA:
      default:
        switch (form_type) {
          case FPDF_FORMFIELD_PUSHBUTTON:
          case FPDF_FORMFIELD_CHECKBOX:
          case FPDF_FORMFIELD_RADIOBUTTON:
          case FPDF_FORMFIELD_COMBOBOX:
          case FPDF_FORMFIELD_LISTBOX:
            cursor = PP_CURSORTYPE_HAND;
            break;
          case FPDF_FORMFIELD_TEXTFIELD:
            cursor = PP_CURSORTYPE_IBEAM;
            break;
#if defined(PDF_ENABLE_XFA)
          case FPDF_FORMFIELD_XFA_CHECKBOX:
          case FPDF_FORMFIELD_XFA_COMBOBOX:
          case FPDF_FORMFIELD_XFA_IMAGEFIELD:
          case FPDF_FORMFIELD_XFA_LISTBOX:
          case FPDF_FORMFIELD_XFA_PUSHBUTTON:
          case FPDF_FORMFIELD_XFA_SIGNATURE:
            cursor = PP_CURSORTYPE_HAND;
            break;
          case FPDF_FORMFIELD_XFA_TEXTFIELD:
            cursor = PP_CURSORTYPE_IBEAM;
            break;
#endif
          default:
            cursor = PP_CURSORTYPE_POINTER;
            break;
        }
        break;
    }

    if (page_index != -1) {
      double page_x;
      double page_y;
      DeviceToPage(page_index, point.x(), point.y(), &page_x, &page_y);
      FORM_OnMouseMove(form_, pages_[page_index]->GetPage(), 0, page_x, page_y);
    }

    client_->UpdateCursor(cursor);
    std::string url = GetLinkAtPosition(event.GetPosition());
    if (url != link_under_cursor_) {
      link_under_cursor_ = url;
      pp::PDF::SetLinkUnderCursor(GetPluginInstance(), url.c_str());
    }

    if (mouse_left_button_down_ && area == PDFiumPage::FORM_TEXT_AREA &&
        last_page_mouse_down_ != -1) {
      SetFormSelectedText(form_, pages_[last_page_mouse_down_]->GetPage());
    }

    return false;
  }

  if (area != PDFiumPage::TEXT_AREA && !IsLinkArea(area))
    return false;

  SelectionChangeInvalidator selection_invalidator(this);
  return ExtendSelection(page_index, char_index);
}

Project: Chrome

void PDFiumEngine::OnPendingRequestComplete() {
  if (!process_when_pending_request_complete_)
    return;
  if (!fpdf_availability_) {
    file_access_.m_FileLen = doc_loader_->GetDocumentSize();
    fpdf_availability_ = FPDFAvail_Create(&file_availability_, &file_access_);
    DCHECK(fpdf_availability_);
    if (FPDFAvail_IsLinearized(fpdf_availability_) != PDF_LINEARIZED) {
      process_when_pending_request_complete_ = false;
      FPDFAvail_Destroy(fpdf_availability_);
      fpdf_availability_ = nullptr;
      return;
    }
  }

  if (!doc_) {
    LoadDocument();
    return;
  }

  if (pages_.empty()) {
    LoadBody();
    return;
  }

  bool update_pages = false;
  std::vector<int> still_pending;
  for (int pending_page : pending_pages_) {
    if (CheckPageAvailable(pending_page, &still_pending)) {
      update_pages = true;
      if (IsPageVisible(pending_page)) {
        client_->NotifyPageBecameVisible(
            pages_[pending_page]->GetPageFeatures());
        client_->Invalidate(GetPageScreenRect(pending_page));
      }
    }
  }
  pending_pages_.swap(still_pending);
  if (update_pages)
    LoadPageInfo(true);
}