From 4b49db22352c860eed4aa69f35518503e0a76af1 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Thu, 01 Oct 2026 09:35:58 -0700
Subject: [PATCH] [PDF] Avoid using invalid destination handle in PDFiumEngine

Page loading can trigger JS that invalidates a destination handle that
PDFiumEngine::GetNamedDestination() uses. Avoid this potential problem
by first using the destination handle to retrieve all the necessary
information, before accessing the page that may invalidate the handle.
Add comments to warn about the potential handle lifetime issues.

Bug: 567873463
Change-Id: Ibda2e22f4ff1653793903a3ff2e58017700f3e03
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8497287
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1709111}
---
diff --git a/pdf/pdfium/pdfium_engine.cc b/pdf/pdfium/pdfium_engine.cc
index 57046ae..7c24231 100644
--- a/pdf/pdfium/pdfium_engine.cc
+++ b/pdf/pdfium/pdfium_engine.cc
@@ -832,6 +832,9 @@
     return xyz_params;
   }
 
+  // WARNING: Do not use `dest` below this point, as `page` access can
+  // invalidate it.
+
   // Generate a string of the parameters
   if (has_x_coord) {
     // Handle out-of-range PDF coordinates and convert PDF coordinates to screen
@@ -3378,21 +3381,23 @@
   }
 
   NamedDestination result;
-  result.page = page;
   unsigned long view_int =
       FPDFDest_GetView(dest, &result.num_params, result.params.data());
-
-  // FPDFDest_GetView() gets the PDF coordinates directly from the PDF document.
-  // The PDF coordinates need to be transformed into screen coordinates before
-  // getting sent to the viewport.
+  result.page = page;
+  result.view = ConvertViewIntToViewString(view_int);
   PDFiumPage* page_ptr = pages_[page].get();
-  ParamsTransformPageToScreen(view_int, page_ptr, result.params);
 
   if (view_int == PDFDEST_VIEW_XYZ) {
     result.xyz_params = GetXYZParamsString(dest, page_ptr);
   }
 
-  result.view = ConvertViewIntToViewString(view_int);
+  // WARNING: Do not use `dest` below this point, as GetXYZParamsString() may
+  // have invalidated it. Or ParamsTransformPageToScreen() may invalidate it.
+
+  // FPDFDest_GetView() gets the PDF coordinates directly from the PDF document.
+  // The PDF coordinates need to be transformed into screen coordinates before
+  // getting sent to the viewport.
+  ParamsTransformPageToScreen(view_int, page_ptr, result.params);
   return result;
 }