commit c8d8bdcb981994b311ee85fb77014b7d07b7ba89
author Tom Sepez <tsepez@chromium.org> Tue Jun 24 11:13:35 2025 -0700
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jun 24 11:13:35 2025 -0700
tree 4c0d613a015399b0bb0b810a2f062dd2f8b0df17
parent af8ef613c25bd95ceeddb8a935af7c9cbb28d628

Fix truncated hash value used in GetEventParaInfoByName().

Comparisons need to be made against the full 32-bit hash, not a
16-bit truncation of it. Then fix logic not previously covered to
handle cases where it might encounter a null ptr.

-- Kill some whitespace.

Fixed: 426611640
Change-Id: I57b2374d4b1241b6bd4211c21f5f4d5bcff632a0
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/133490
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

fxjs/xfa/cjx_node.cpp

diff --git a/fxjs/xfa/cjx_node.cpp b/fxjs/xfa/cjx_node.cpp
index 5f23067..edb2e2d 100644
--- a/fxjs/xfa/cjx_node.cpp
+++ b/fxjs/xfa/cjx_node.cpp
@@ -81,7 +81,7 @@
   uint32_t uHash = FX_HashCode_GetW(wsEventName);
   auto* result = std::lower_bound(
       std::begin(kExecEventParaInfoTable), std::end(kExecEventParaInfoTable),
-      uHash, [](const ExecEventParaInfo& iter, const uint16_t& hash) {
+      uHash, [](const ExecEventParaInfo& iter, const uint32_t& hash) {
         return iter.hash_ < hash;
       });
   if (result != std::end(kExecEventParaInfoTable) && result->hash_ == uHash) {
@@ -512,14 +512,12 @@
       if (eType != XFA_Element::Subform) {
         return XFA_EventError::kNotExist;
       }
-
       return pNotify->ExecEventByDeepFirst(
           GetXFANode(), eventParaInfo->event_type_, false, false);
     case EventAppliesTo::kFieldOrExclusion: {
       if (eType != XFA_Element::ExclGroup && eType != XFA_Element::Field) {
         return XFA_EventError::kNotExist;
       }
-
       CXFA_Node* pParentNode = GetXFANode()->GetParent();
       if (pParentNode &&
           pParentNode->GetElementType() == XFA_Element::ExclGroup) {
@@ -534,15 +532,15 @@
       if (eType != XFA_Element::Field) {
         return XFA_EventError::kNotExist;
       }
-
       return pNotify->ExecEventByDeepFirst(
           GetXFANode(), eventParaInfo->event_type_, false, false);
     case EventAppliesTo::kSignature: {
       if (!GetXFANode()->IsWidgetReady()) {
         return XFA_EventError::kNotExist;
       }
-      if (GetXFANode()->GetUIChildNode()->GetElementType() !=
-          XFA_Element::Signature) {
+      CXFA_Node* pChildNode = GetXFANode()->GetUIChildNode();
+      if (!pChildNode ||
+          pChildNode->GetElementType() != XFA_Element::Signature) {
         return XFA_EventError::kNotExist;
       }
       return pNotify->ExecEventByDeepFirst(
@@ -552,8 +550,9 @@
       if (!GetXFANode()->IsWidgetReady()) {
         return XFA_EventError::kNotExist;
       }
-      if (GetXFANode()->GetUIChildNode()->GetElementType() !=
-          XFA_Element::ChoiceList) {
+      CXFA_Node* pChildNode = GetXFANode()->GetUIChildNode();
+      if (!pChildNode ||
+          pChildNode->GetElementType() != XFA_Element::Signature) {
         return XFA_EventError::kNotExist;
       }
       return pNotify->ExecEventByDeepFirst(