Gate GDI APIs behind IsUser32AndGdi32Available in cpdf_interactiveform.cpp Under win32k lockdown, which is detectable using the IsUser32AndGdi32Available helper function and used in chromium renderer and service sandboxes, APIs which call into win32k.sys like GetDC, EnumFontFamiliesExW, ReleaseDC will no-op in the kernel and fail or return no data. We're planning make chromium changes that will cause the DLLs hosting these APIs to fail to load (and crash in the delayload runtime) under win32k lockdown, adding these if checks will prevent us from trying to load the dlls. By only ever returning kDefaultAnsiFontName or an empty string from GetNativeFontName, then we never call AddWindowsFont in AddNativeFont either, as AddNativeFont also calls GDI APIs. Bug: pdfium:2140 Change-Id: I0ded3ace2cde39d4f9f4529707af616daed44366 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/118172 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Thomas Sepez <tsepez@google.com> Reviewed-by: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fpdfdoc/cpdf_interactiveform.cpp b/core/fpdfdoc/cpdf_interactiveform.cpp index fe7c07a..5a01ad2 100644 --- a/core/fpdfdoc/cpdf_interactiveform.cpp +++ b/core/fpdfdoc/cpdf_interactiveform.cpp
@@ -36,6 +36,10 @@ #include "core/fxcrt/stl_util.h" #include "core/fxge/fx_font.h" +#if BUILDFLAG(IS_WIN) +#include "core/fxcrt/win/win_util.h" +#endif + namespace { const int nMaxRecursion = 32; @@ -89,9 +93,16 @@ #if BUILDFLAG(IS_WIN) LOGFONTA lf = {}; if (charSet == FX_Charset::kANSI) { - csFontName = CFX_Font::kDefaultAnsiFontName; - return csFontName; + return CFX_Font::kDefaultAnsiFontName; } + + if (!pdfium::IsUser32AndGdi32Available()) { + // Without GDI32 and User32, GetDC / EnumFontFamiliesExW / ReleaseDC all + // fail, which is called by RetrieveSpecificFont. We won't be able to look + // up native fonts without GDI. + return ByteString(); + } + bool bRet = false; const ByteString default_font_name = CFX_Font::GetDefaultFontNameByCharset(charSet);