commit f5777a117a7557507616eaf585de5eb266531e16
author Henrique Nakashima <hnakashima@chromium.org> Fri Sep 22 12:23:47 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Fri Sep 22 18:22:06 2017 +0000
tree 6aa102811db0d7e110acb38915699177efcab77f
parent 92827b695a69c7a3fd5940dc0aa1713fe3f3ee96

Fix UAF after destroying a widget during OnBeforeKeyStroke().

Bug: chromium:766957
Change-Id: I61b282059fb4fc2c8ba6dafc502f030f31dd324d
Reviewed-on: https://pdfium-review.googlesource.com/14710
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

fpdfsdk/pwl/cpwl_edit.cpp

diff --git a/fpdfsdk/pwl/cpwl_edit.cpp b/fpdfsdk/pwl/cpwl_edit.cpp
index 0b74a18..662c69e 100644
--- a/fpdfsdk/pwl/cpwl_edit.cpp
+++ b/fpdfsdk/pwl/cpwl_edit.cpp
@@ -481,11 +481,17 @@
       if (nSelStart == nSelEnd)
         nSelEnd = nSelStart + 1;
 
+      CPWL_Wnd::ObservedPtr thisObserved(this);
+
       bool bRC;
       bool bExit;
       std::tie(bRC, bExit) = m_pFillerNotify->OnBeforeKeyStroke(
           GetAttachedData(), strChange, strChangeEx, nSelStart, nSelEnd, true,
           nFlag);
+
+      if (!thisObserved)
+        return false;
+
       if (!bRC)
         return false;
       if (bExit)
@@ -558,10 +564,15 @@
           break;
       }
 
+      CPWL_Wnd::ObservedPtr thisObserved(this);
+
       WideString strChangeEx;
       std::tie(bRC, bExit) = m_pFillerNotify->OnBeforeKeyStroke(
           GetAttachedData(), swChange, strChangeEx, nSelStart, nSelEnd, true,
           nFlag);
+
+      if (!thisObserved)
+        return false;
     }
   }
 

fpdfsdk/pwl/cpwl_list_box.cpp

diff --git a/fpdfsdk/pwl/cpwl_list_box.cpp b/fpdfsdk/pwl/cpwl_list_box.cpp
index b5c6293..c8f7be9 100644
--- a/fpdfsdk/pwl/cpwl_list_box.cpp
+++ b/fpdfsdk/pwl/cpwl_list_box.cpp
@@ -260,6 +260,8 @@
   if (!m_pFillerNotify)
     return false;
 
+  CPWL_Wnd::ObservedPtr thisObserved(this);
+
   WideString swChange = GetText();
   WideString strChangeEx;
   int nSelStart = 0;
@@ -269,6 +271,10 @@
   std::tie(bRC, bExit) = m_pFillerNotify->OnBeforeKeyStroke(
       GetAttachedData(), swChange, strChangeEx, nSelStart, nSelEnd, bKeyDown,
       nFlag);
+
+  if (!thisObserved)
+    return false;
+
   return bExit;
 }