commit c9d6d68e9b91a0373d8aac42cdde5dac1925ec42
author Ryan Harrison <rharrison@chromium.org> Tue Aug 29 12:21:32 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Tue Aug 29 18:42:43 2017 +0000
tree 7077b7e2cc6941975ce03fc93b9f7ae76510bddf
parent 31f7e4bb502e617a54da04a7600e8be7e2b62756

Fix incorrectly guarded lexer advancement in FormCalc parser

BUG=chromium:752501

Change-Id: Ie9943cd80a4afa73ad9393c8bcd2aa2656a9d932
Reviewed-on: https://pdfium-review.googlesource.com/12290
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

xfa/fxfa/fm2js/cxfa_fmparser.cpp

diff --git a/xfa/fxfa/fm2js/cxfa_fmparser.cpp b/xfa/fxfa/fm2js/cxfa_fmparser.cpp
index 2981a4d..18c37c5 100644
--- a/xfa/fxfa/fm2js/cxfa_fmparser.cpp
+++ b/xfa/fxfa/fm2js/cxfa_fmparser.cpp
@@ -814,7 +814,7 @@
         }
         CFX_WideStringC tempStr = m_token->m_string;
         uint32_t tempLine = m_token->m_line_num;
-        if (NextToken())
+        if (!NextToken())
           return nullptr;
         if (m_token->m_type != TOKlbracket) {
           std::unique_ptr<CXFA_FMSimpleExpression> s =

xfa/fxfa/fm2js/cxfa_fmparser_unittest.cpp

diff --git a/xfa/fxfa/fm2js/cxfa_fmparser_unittest.cpp b/xfa/fxfa/fm2js/cxfa_fmparser_unittest.cpp
index 214fd4a..4a17067 100644
--- a/xfa/fxfa/fm2js/cxfa_fmparser_unittest.cpp
+++ b/xfa/fxfa/fm2js/cxfa_fmparser_unittest.cpp
@@ -114,3 +114,12 @@
   EXPECT_EQ(nullptr, parser->Parse());
   EXPECT_TRUE(parser->HasError());
 }
+
+TEST(CFXA_FMParserTest, chromium752201) {
+  auto parser = pdfium::MakeUnique<CXFA_FMParser>(
+      L"fTep a\n"
+      L".#\n"
+      L"fo@ =[=l");
+  EXPECT_EQ(nullptr, parser->Parse());
+  EXPECT_TRUE(parser->HasError());
+}