commit 76d01feaeec421ebe6005f22de85998220703dd2
author Lei Zhang <thestig@chromium.org> Fri Jun 08 18:05:58 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Fri Jun 08 18:05:58 2018 +0000
tree bf6333d06b3834849ceb82ad97ccf0ad2054040d
parent d8a8f2785144f6656cd84c82c865eed62885d36b

Do not crash if FPDFPage_Get{Media,Crop}Box() gets a NULL out parameter.

Change-Id: I4b61d4c7239caaf6081bcba80cc0d8ad61569474
Reviewed-on: https://pdfium-review.googlesource.com/34590
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>

fpdfsdk/fpdf_transformpage.cpp

diff --git a/fpdfsdk/fpdf_transformpage.cpp b/fpdfsdk/fpdf_transformpage.cpp
index a3ba7ca..210c6b6 100644
--- a/fpdfsdk/fpdf_transformpage.cpp
+++ b/fpdfsdk/fpdf_transformpage.cpp
@@ -36,6 +36,9 @@
                     float* bottom,
                     float* right,
                     float* top) {
+  if (!left || !bottom || !right || !top)
+    return false;
+
   CPDF_Array* pArray = page->GetDict()->GetArrayFor(key);
   if (!pArray)
     return false;

fpdfsdk/fpdf_transformpage_embeddertest.cpp

diff --git a/fpdfsdk/fpdf_transformpage_embeddertest.cpp b/fpdfsdk/fpdf_transformpage_embeddertest.cpp
index d064efe..1ebd0f0 100644
--- a/fpdfsdk/fpdf_transformpage_embeddertest.cpp
+++ b/fpdfsdk/fpdf_transformpage_embeddertest.cpp
@@ -66,6 +66,16 @@
     EXPECT_EQ(60, cropbox_right);
     EXPECT_EQ(60, cropbox_top);
 
+    EXPECT_FALSE(FPDFPage_GetCropBox(page, nullptr, &cropbox_bottom,
+                                     &cropbox_right, &cropbox_top));
+    EXPECT_FALSE(FPDFPage_GetCropBox(page, &cropbox_left, nullptr,
+                                     &cropbox_right, &cropbox_top));
+    EXPECT_FALSE(FPDFPage_GetCropBox(page, &cropbox_left, &cropbox_bottom,
+                                     nullptr, &cropbox_top));
+    EXPECT_FALSE(FPDFPage_GetCropBox(page, &cropbox_left, &cropbox_bottom,
+                                     &cropbox_right, nullptr));
+    EXPECT_FALSE(FPDFPage_GetCropBox(page, nullptr, nullptr, nullptr, nullptr));
+
     UnloadPage(page);
   }
 }