ASAN flags zero-length StringC in GetMapModuleString()
Corner case for StringCs: A non-referenceable ptr plus a
zero length.
The situation should be rare, so fix it at the spot of the
foul rather than adding logic to the StringC constructors to
zero the pointer when encountering zero length.
Bug: 724500
Change-Id: I54b263f7db5ddef7bade6bfaa185a542ea20229c
Reviewed-on: https://pdfium-review.googlesource.com/5730
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index e136814..8830f34 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -4854,10 +4854,11 @@
bool CXFA_Node::GetMapModuleString(void* pKey, CFX_WideStringC& wsValue) {
void* pValue;
int32_t iBytes;
- if (!GetMapModuleBuffer(pKey, pValue, iBytes)) {
+ if (!GetMapModuleBuffer(pKey, pValue, iBytes))
return false;
- }
- wsValue = CFX_WideStringC((const wchar_t*)pValue, iBytes / sizeof(wchar_t));
+ // Defensive measure: no out-of-bounds pointers even if zero length.
+ int32_t iChars = iBytes / sizeof(wchar_t);
+ wsValue = CFX_WideStringC(iChars ? (const wchar_t*)pValue : nullptr, iChars);
return true;
}
