commit e06acb7de1b8c9e554c1b8dfa4974aca8ac46190
author Tom Sepez <tsepez@chromium.org> Tue Feb 04 18:23:26 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Tue Feb 04 18:23:26 2020 +0000
tree 6dd1f4112a911a0b8a196ae7f4db1110785412ac
parent c1a77e4cefcea05ccf1f1218e1beb74d70f8ebc8

Ensure label item lists are not excessively sized in CXFA_FFListBox.

Truncate any spurious labels which do not correspond to underlying
settable values.

Bug: chromium:1047914
Change-Id: I0ba4cf09fb177f491f835d9f3046dea5df641fc4
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/65930
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

testing/resources/javascript/xfa_specific/bug_1047914.evt

diff --git a/testing/resources/javascript/xfa_specific/bug_1047914.evt b/testing/resources/javascript/xfa_specific/bug_1047914.evt
new file mode 100644
index 0000000..45b948d
--- /dev/null
+++ b/testing/resources/javascript/xfa_specific/bug_1047914.evt
@@ -0,0 +1,4 @@
+mousedown,left,0,2
+mouseup,left,0,2
+mousedown,left,0,2
+mouseup,left,0,2
\ No newline at end of file

testing/resources/javascript/xfa_specific/bug_1047914.in

diff --git a/testing/resources/javascript/xfa_specific/bug_1047914.in b/testing/resources/javascript/xfa_specific/bug_1047914.in
new file mode 100644
index 0000000..969d7a0
--- /dev/null
+++ b/testing/resources/javascript/xfa_specific/bug_1047914.in
@@ -0,0 +1,47 @@
+{{header}}
+{{object 1 0}} <<
+  /AcroForm <<
+    /XFA 2 0 R
+  >>
+>>
+endobj
+{{object 2 0}} <<
+  {{streamlen}}
+>>
+stream
+<xdp xmlns="http://ns.adobe.com/xdp/">
+  <config>
+    <acrobat>
+      <acrobat7>
+        <dynamicRender>required</dynamicRender>
+      </acrobat7>
+    </acrobat>
+    <present>
+      <pdf>
+        <interactive>1</interactive>
+      </pdf>
+    </present>
+  </config>
+  <template>
+    <subform>
+      <bookend leader="$"></bookend>
+      <keep previous="pageArea"></keep>
+      <field anchorType="middleCenter">
+        <ui>
+          <choiceList open="multiSelect">
+            <border><edge stroke="raised"></edge></border>
+            <margin></margin>
+          </choiceList>
+        </ui>
+        <items save="1"><float>41.0</float></items>
+        <items><float>43.0</float><integer>44</integer></items>
+      </field>
+    </subform>
+  </template>
+</xdp>
+endstream
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
\ No newline at end of file

xfa/fxfa/cxfa_fflistbox.cpp

diff --git a/xfa/fxfa/cxfa_fflistbox.cpp b/xfa/fxfa/cxfa_fflistbox.cpp
index 45162ee..2720514 100644
--- a/xfa/fxfa/cxfa_fflistbox.cpp
+++ b/xfa/fxfa/cxfa_fflistbox.cpp
@@ -54,7 +54,12 @@
 
   {
     CFWL_Widget::ScopedUpdateLock update_lock(pListBox);
-    for (const auto& label : m_pNode->GetChoiceListItems(false))
+    std::vector<WideString> displayables = m_pNode->GetChoiceListItems(false);
+    std::vector<WideString> settables = m_pNode->GetChoiceListItems(true);
+    if (displayables.size() > settables.size())
+      displayables.resize(settables.size());
+
+    for (const auto& label : displayables)
       pListBox->AddString(label);
 
     uint32_t dwExtendedStyle = FWL_STYLEEXT_LTB_ShowScrollBarFocus;