tree 9b8fd5ab032f8733af469270a8622f29ca3e5d82
parent 7734ba9a7d52f1e4f14fb7a3c84b282684758519
author huyna <huyna89@gmail.com> 1564087283 +0000
committer Chromium commit bot <commit-bot@chromium.org> 1564087283 +0000

Prevent an UAF in CPDFSDK_AnnotHandlerMgr::GetNextAnnot().

Calling CXFA_FFPageView::CreateWidgetIterator() can trigger JS and
invalidate CPDFSDK_Annot objects. Use ObservedPtr to check for
CPDFSDK_Annot destruction to catch this.

Bug: chromium:980161
Change-Id: Ifdb926be75c129d7b4a05c3b1fb8c747ef352e71
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/58171
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>