From ff834f798fe3b7649892f36a6a9cb14ad6f01672 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Thu, 01 Oct 2026 09:55:35 -0700
Subject: [PATCH] [PDF] Avoid using invalid link handle in PDFiumPage

Page loading can trigger JS that invalidates a link handle that
PDFiumPage::PopulateAnnotationLinks() uses. Avoid this potential problem
by first using the link handle to retrieve all the necessary
information, before accessing the page that may invalidate the handle.
Add comments to warn about the potential handle lifetime issues.

Bug: 567910530
Change-Id: Ic797764cf397a1e3986617faadf358eba1d32472
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8492452
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1709135}
---
diff --git a/pdf/pdfium/pdfium_page.cc b/pdf/pdfium/pdfium_page.cc
index 30ecfc4..ef209e3 100644
--- a/pdf/pdfium/pdfium_page.cc
+++ b/pdf/pdfium/pdfium_page.cc
@@ -1584,11 +1584,6 @@
   // deletions below prevents one of them from erasing another.
   std::vector<Link> annotation_links;
   while (FPDFLink_Enumerate(page, &start_pos, &link_annot)) {
-    Link link;
-    Area area = GetLinkTarget(link_annot, &link.target);
-    if (area == NONSELECTABLE_AREA)
-      continue;
-
     PdfRect link_rect;
     if (!FPDFLink_GetAnnotRect(link_annot, &FsRectFFromPdfRect(link_rect))) {
       continue;
@@ -1598,6 +1593,7 @@
     // flipped. Swap the coordinates before further processing.
     link_rect.Normalize();
 
+    Link link;
     int quad_point_count = FPDFLink_CountQuadPoints(link_annot);
     // Calculate the bounds of link using the quad points data.
     // If quad points for link is not present then use
@@ -1618,6 +1614,15 @@
                                                  PageOrientation::kOriginal));
     }
 
+    // WARNING: Do not use `link_annot` after this call. It may have been
+    // invalidated.
+    Area area = GetLinkTarget(link_annot, &link.target);
+    if (area == NONSELECTABLE_AREA) {
+      // It is unfortunate that all the work above may get thrown away due to
+      // how `link_annot` access have to be arranged to be safe.
+      continue;
+    }
+
     // Calculate underlying text range of link.
     GetUnderlyingTextRangeForRect(
         gfx::RectF(link_rect.left(), link_rect.bottom(), link_rect.width(),