Reject XFA-only pages in FPDFPage_Flatten()

FPDFPage_Flatten() converted its page handle to CPDF_Page but checked
the original handle for null. A full-XFA page without PDF backing
therefore reached a null CPDF_Page dereference.

Check the converted pointer and cover the failure with an XFA embedder
test.

Bug: 533167360
Change-Id: Ifa1fd59f5fe4d1639f6c6c9e69e0ee412d720758
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/151810
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

fpdfsdk/fpdf_flatten.cpp

diff --git a/fpdfsdk/fpdf_flatten.cpp b/fpdfsdk/fpdf_flatten.cpp
index 3d56f92..483527e 100644
--- a/fpdfsdk/fpdf_flatten.cpp
+++ b/fpdfsdk/fpdf_flatten.cpp
@@ -445,7 +445,7 @@
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFPage_Flatten(FPDF_PAGE page, int nFlag) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!page) {
+  if (!pPage) {
     return FLATTEN_FAIL;
   }
 

fpdfsdk/fpdf_flatten_embeddertest.cpp

diff --git a/fpdfsdk/fpdf_flatten_embeddertest.cpp b/fpdfsdk/fpdf_flatten_embeddertest.cpp
index 5c54f14..23a18d5 100644
--- a/fpdfsdk/fpdf_flatten_embeddertest.cpp
+++ b/fpdfsdk/fpdf_flatten_embeddertest.cpp
@@ -28,6 +28,19 @@
             FPDFPage_Flatten(page.get(), FLAT_NORMALDISPLAY));
 }
 
+#if defined(PDF_ENABLE_XFA)
+TEST_F(FPDFFlattenEmbedderTest, RejectsFullXfaPageWithoutPdfBacking) {
+  ASSERT_TRUE(OpenDocument("simple_xfa.pdf"));
+  ASSERT_EQ(FORMTYPE_XFA_FULL, FPDF_GetFormType(document()));
+  ScopedPage page = LoadScopedPage(0);
+  ASSERT_TRUE(page);
+
+  FS_RECTF bounds;
+  ASSERT_FALSE(FPDF_GetPageBoundingBox(page.get(), &bounds));
+  EXPECT_EQ(FLATTEN_FAIL, FPDFPage_Flatten(page.get(), FLAT_NORMALDISPLAY));
+}
+#endif  // defined(PDF_ENABLE_XFA)
+
 TEST_F(FPDFFlattenEmbedderTest, FlatNormal) {
   ASSERT_TRUE(OpenDocument("annotiter.pdf"));
   ScopedPage page = LoadScopedPage(0);