Validate index in page of page objects sent to PdfAccessibilityTree

Page object data that PdfAccessibilityTree receives have |index_in_page|
property. It is basically the index on that page object in the list of
that type of page object. For e.g. |page_in_index| of a link is the
index of the link in vector of links.

The validation implemented in this change is to check that
|index_in_page| is with in bounds of the page object vector.

Change-Id: Ic3ccf0aa2d988adbe1f6e8dd373b0852c96cb4db
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2279250
Commit-Queue: Virender Singh <virens@microsoft.com>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Ankit Kumar 🌪️ <ankk@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#785674}

components/pdf/renderer/pdf_accessibility_tree.cc

@@ -941,11 +941,15 @@ bool PdfAccessibilityTree::IsDataFromPluginValid(
   // |text_runs|. The index denotes the position of the link relative to the
   // text runs. The index value equal to the size of |text_runs| indicates that
   // the link should be after the last text run.
+  // |index_in_page| of every |link| should be with in the range of total number
+  // of links, which is size of |links|.
   for (const ppapi::PdfAccessibilityLinkInfo& link : links) {
     base::CheckedNumeric<uint32_t> index = link.text_run_index;
     index += link.text_run_count;
-    if (!index.IsValid() || index.ValueOrDie() > text_runs.size())
+    if (!index.IsValid() || index.ValueOrDie() > text_runs.size() ||
+        link.index_in_page >= links.size()) {
       return false;
+    }
   }
 
   const std::vector<ppapi::PdfAccessibilityImageInfo>& images =
@@ -970,11 +974,15 @@ bool PdfAccessibilityTree::IsDataFromPluginValid(
 
   // Since highlights also span across text runs similar to links, the
   // validation method is the same.
+  // |index_in_page| of a |highlight| follows the same index validation rules
+  // as of links.
   for (const auto& highlight : highlights) {
     base::CheckedNumeric<uint32_t> index = highlight.text_run_index;
     index += highlight.text_run_count;
-    if (!index.IsValid() || index.ValueOrDie() > text_runs.size())
+    if (!index.IsValid() || index.ValueOrDie() > text_runs.size() ||
+        highlight.index_in_page >= highlights.size()) {
       return false;
+    }
   }
 
   const std::vector<ppapi::PdfAccessibilityTextFieldInfo>& text_fields =
@@ -985,9 +993,13 @@ bool PdfAccessibilityTree::IsDataFromPluginValid(
   }
   // Text run index of an |text_field| works on the same logic as the text run
   // index of a |link| as mentioned above.
+  // |index_in_page| of a |text_field| follows the same index validation rules
+  // as of links.
   for (const ppapi::PdfAccessibilityTextFieldInfo& text_field : text_fields) {
-    if (text_field.text_run_index > text_runs.size())
+    if (text_field.text_run_index > text_runs.size() ||
+        text_field.index_in_page >= text_fields.size()) {
       return false;
+    }
   }
 
   const std::vector<ppapi::PdfAccessibilityChoiceFieldInfo>& choice_fields =
@@ -999,9 +1011,13 @@ bool PdfAccessibilityTree::IsDataFromPluginValid(
   }
   // Text run index of an |choice_field| works on the same logic as the text run
   // index of a |link| as mentioned above.
+  // |index_in_page| of a |choice_field| follows the same index validation rules
+  // as of links.
   for (const auto& choice_field : choice_fields) {
-    if (choice_field.text_run_index > text_runs.size())
+    if (choice_field.text_run_index > text_runs.size() ||
+        choice_field.index_in_page >= choice_fields.size()) {
       return false;
+    }
   }
 
   const std::vector<ppapi::PdfAccessibilityButtonInfo>& buttons =
@@ -1015,9 +1031,12 @@ bool PdfAccessibilityTree::IsDataFromPluginValid(
        buttons) {
     // Text run index of an |button| works on the same logic as the text run
     // index of a |link| as mentioned above.
-    if (button.text_run_index > text_runs.size())
+    // |index_in_page| of a |button| follows the same index validation rules as
+    // of links.
+    if (button.text_run_index > text_runs.size() ||
+        button.index_in_page >= buttons.size()) {
       return false;
-
+    }
     // For radio button or checkbox, value of |button.control_index| should
     // always be less than |button.control_count|.
     if ((button.type == PP_PrivateButtonType::PP_PRIVATEBUTTON_CHECKBOX ||

components/pdf/renderer/pdf_accessibility_tree_browsertest.cc

@@ -247,6 +247,7 @@ TEST_F(PdfAccessibilityTreeTest, TestPdfAccessibilityTreeCreation) {
     link.url = kChromiumTestUrl;
     link.text_run_index = 0;
     link.text_run_count = 1;
+    link.index_in_page = 0;
     page_objects_.links.push_back(std::move(link));
   }
 
@@ -362,6 +363,7 @@ TEST_F(PdfAccessibilityTreeTest, TestOverlappingAnnots) {
     link.url = kChromiumTestUrl;
     link.text_run_index = 0;
     link.text_run_count = 3;
+    link.index_in_page = 0;
     page_objects_.links.push_back(std::move(link));
   }
 
@@ -371,6 +373,7 @@ TEST_F(PdfAccessibilityTreeTest, TestOverlappingAnnots) {
     link.url = kChromiumTestUrl;
     link.text_run_index = 1;
     link.text_run_count = 2;
+    link.index_in_page = 1;
     page_objects_.links.push_back(std::move(link));
   }
 
@@ -460,6 +463,7 @@ TEST_F(PdfAccessibilityTreeTest, TestHighlightCreation) {
     highlight.bounds = PP_MakeFloatRectFromXYWH(1.0f, 1.0f, 5.0f, 6.0f);
     highlight.text_run_index = 0;
     highlight.text_run_count = 2;
+    highlight.index_in_page = 0;
     highlight.color = kHighlightWhiteColor;
     highlight.note_text = kPopupNoteText;
     page_objects_.highlights.push_back(std::move(highlight));
@@ -680,6 +684,7 @@ TEST_F(PdfAccessibilityTreeTest, TestPreviousNextOnLine) {
     link.url = kChromiumTestUrl;
     link.text_run_index = 2;
     link.text_run_count = 2;
+    link.index_in_page = 0;
     page_objects_.links.push_back(std::move(link));
   }
 
@@ -874,6 +879,7 @@ TEST_F(PdfAccessibilityTreeTest, OutOfBoundLink) {
     ppapi::PdfAccessibilityLinkInfo link;
     link.bounds = PP_MakeFloatRectFromXYWH(0.0f, 0.0f, 0.0f, 0.0f);
     link.text_run_index = 3;
+    link.index_in_page = 0;
     link.text_run_count = 0;
     page_objects_.links.push_back(std::move(link));
   }
@@ -988,6 +994,7 @@ TEST_F(PdfAccessibilityTreeTest, UnsortedHighlightVector) {
     highlight.bounds = PP_MakeFloatRectFromXYWH(0.0f, 0.0f, 1.0f, 1.0f);
     highlight.text_run_index = 2;
     highlight.text_run_count = 0;
+    highlight.index_in_page = 0;
     page_objects_.highlights.push_back(std::move(highlight));
   }
 
@@ -997,6 +1004,7 @@ TEST_F(PdfAccessibilityTreeTest, UnsortedHighlightVector) {
     highlight.bounds = PP_MakeFloatRectFromXYWH(2.0f, 2.0f, 1.0f, 1.0f);
     highlight.text_run_index = 0;
     highlight.text_run_count = 1;
+    highlight.index_in_page = 1;
     page_objects_.highlights.push_back(std::move(highlight));
   }
 
@@ -1033,6 +1041,7 @@ TEST_F(PdfAccessibilityTreeTest, OutOfBoundHighlight) {
     highlight.bounds = PP_MakeFloatRectFromXYWH(0.0f, 0.0f, 1.0f, 1.0f);
     highlight.text_run_index = 3;
     highlight.text_run_count = 0;
+    highlight.index_in_page = 0;
     page_objects_.highlights.push_back(std::move(highlight));
   }
 

components/pdf/renderer/pdf_accessibility_tree_unittest.cc

@@ -69,6 +69,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedLinkVector) {
     ppapi::PdfAccessibilityLinkInfo link;
     link.text_run_index = 2;
     link.text_run_count = 0;
+    link.index_in_page = 0;
     page_objects.links.push_back(std::move(link));
   }
 
@@ -77,6 +78,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedLinkVector) {
     ppapi::PdfAccessibilityLinkInfo link;
     link.text_run_index = 0;
     link.text_run_count = 1;
+    link.index_in_page = 1;
     page_objects.links.push_back(std::move(link));
   }
 
@@ -98,6 +100,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundLink) {
     ppapi::PdfAccessibilityLinkInfo link;
     link.text_run_index = 3;
     link.text_run_count = 0;
+    link.index_in_page = 0;
     page_objects.links.push_back(std::move(link));
   }
 
@@ -168,6 +171,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedHighlightVector) {
     ppapi::PdfAccessibilityHighlightInfo highlight;
     highlight.text_run_index = 2;
     highlight.text_run_count = 0;
+    highlight.index_in_page = 0;
     page_objects.highlights.push_back(std::move(highlight));
   }
 
@@ -176,6 +180,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedHighlightVector) {
     ppapi::PdfAccessibilityHighlightInfo highlight;
     highlight.text_run_index = 0;
     highlight.text_run_count = 1;
+    highlight.index_in_page = 1;
     page_objects.highlights.push_back(std::move(highlight));
   }
 
@@ -197,6 +202,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundHighlight) {
     ppapi::PdfAccessibilityHighlightInfo highlight;
     highlight.text_run_index = 3;
     highlight.text_run_count = 0;
+    highlight.index_in_page = 0;
     page_objects.highlights.push_back(std::move(highlight));
   }
 
@@ -218,6 +224,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedTextFieldVector) {
     // Add first text field in the vector.
     ppapi::PdfAccessibilityTextFieldInfo text_field;
     text_field.text_run_index = 2;
+    text_field.index_in_page = 0;
     page_objects.form_fields.text_fields.push_back(std::move(text_field));
   }
 
@@ -225,6 +232,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedTextFieldVector) {
     // Add second text field in the vector.
     ppapi::PdfAccessibilityTextFieldInfo text_field;
     text_field.text_run_index = 0;
+    text_field.index_in_page = 1;
     page_objects.form_fields.text_fields.push_back(std::move(text_field));
   }
 
@@ -245,6 +253,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundTextField) {
   {
     ppapi::PdfAccessibilityTextFieldInfo text_field;
     text_field.text_run_index = 3;
+    text_field.index_in_page = 0;
     page_objects.form_fields.text_fields.push_back(std::move(text_field));
   }
 
@@ -266,6 +275,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedChoiceFieldVector) {
     // Add first choice field in the vector.
     ppapi::PdfAccessibilityChoiceFieldInfo choice_field;
     choice_field.text_run_index = 2;
+    choice_field.index_in_page = 0;
     page_objects.form_fields.choice_fields.push_back(std::move(choice_field));
   }
 
@@ -273,6 +283,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedChoiceFieldVector) {
     // Add second choice field in the vector.
     ppapi::PdfAccessibilityChoiceFieldInfo choice_field;
     choice_field.text_run_index = 0;
+    choice_field.index_in_page = 1;
     page_objects.form_fields.choice_fields.push_back(std::move(choice_field));
   }
 
@@ -293,6 +304,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundChoiceField) {
   {
     ppapi::PdfAccessibilityChoiceFieldInfo choice_field;
     choice_field.text_run_index = 3;
+    choice_field.index_in_page = 0;
     page_objects.form_fields.choice_fields.push_back(std::move(choice_field));
   }
 
@@ -314,6 +326,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedButtonVector) {
     // Add first button in the vector.
     ppapi::PdfAccessibilityButtonInfo button;
     button.text_run_index = 2;
+    button.index_in_page = 0;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -321,6 +334,7 @@ TEST(PdfAccessibilityTreeUnitTest, UnsortedButtonVector) {
     // Add second button in the vector.
     ppapi::PdfAccessibilityButtonInfo button;
     button.text_run_index = 0;
+    button.index_in_page = 1;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -341,6 +355,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundButton) {
   {
     ppapi::PdfAccessibilityButtonInfo button;
     button.text_run_index = 3;
+    button.index_in_page = 0;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -364,6 +379,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundRadioButton) {
     button.text_run_index = 0;
     button.control_index = 1;
     button.control_count = 2;
+    button.index_in_page = 0;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -376,6 +392,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundRadioButton) {
     button.text_run_index = 0;
     button.control_index = 3;
     button.control_count = 2;
+    button.index_in_page = 1;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -399,6 +416,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundCheckBox) {
     button.text_run_index = 0;
     button.control_index = 1;
     button.control_count = 2;
+    button.index_in_page = 0;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -411,6 +429,7 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundCheckBox) {
     button.text_run_index = 0;
     button.control_index = 3;
     button.control_count = 2;
+    button.index_in_page = 1;
     page_objects.form_fields.buttons.push_back(std::move(button));
   }
 
@@ -418,4 +437,90 @@ TEST(PdfAccessibilityTreeUnitTest, OutOfBoundCheckBox) {
                                                            page_objects));
 }
 
+TEST(PdfAccessibilityTreeUnitTest, OutOfBoundIndexInPageLink) {
+  std::vector<ppapi::PdfAccessibilityTextRunInfo> text_runs;
+  text_runs.emplace_back(kFirstTextRun);
+  text_runs.emplace_back(kSecondTextRun);
+
+  std::vector<PP_PrivateAccessibilityCharInfo> chars(
+      std::begin(kDummyCharsData), std::end(kDummyCharsData));
+
+  ppapi::PdfAccessibilityPageObjects page_objects;
+
+  {
+    // Add first link in the vector.
+    ppapi::PdfAccessibilityLinkInfo link;
+    link.text_run_index = 1;
+    link.text_run_count = 0;
+    link.index_in_page = 1;
+    page_objects.links.push_back(std::move(link));
+  }
+
+  EXPECT_FALSE(PdfAccessibilityTree::IsDataFromPluginValid(text_runs, chars,
+                                                           page_objects));
+}
+
+TEST(PdfAccessibilityTreeUnitTest, OutOfBoundIndexInPageHighlight) {
+  std::vector<ppapi::PdfAccessibilityTextRunInfo> text_runs;
+  text_runs.emplace_back(kFirstTextRun);
+  text_runs.emplace_back(kSecondTextRun);
+
+  std::vector<PP_PrivateAccessibilityCharInfo> chars(
+      std::begin(kDummyCharsData), std::end(kDummyCharsData));
+
+  ppapi::PdfAccessibilityPageObjects page_objects;
+
+  {
+    ppapi::PdfAccessibilityHighlightInfo highlight;
+    highlight.text_run_index = 1;
+    highlight.text_run_count = 0;
+    highlight.index_in_page = 1;
+    page_objects.highlights.push_back(std::move(highlight));
+  }
+
+  EXPECT_FALSE(PdfAccessibilityTree::IsDataFromPluginValid(text_runs, chars,
+                                                           page_objects));
+}
+
+TEST(PdfAccessibilityTreeUnitTest, OutOfBoundIndexInPageTextFeild) {
+  std::vector<ppapi::PdfAccessibilityTextRunInfo> text_runs;
+  text_runs.emplace_back(kFirstTextRun);
+  text_runs.emplace_back(kSecondTextRun);
+
+  std::vector<PP_PrivateAccessibilityCharInfo> chars(
+      std::begin(kDummyCharsData), std::end(kDummyCharsData));
+
+  ppapi::PdfAccessibilityPageObjects page_objects;
+
+  {
+    ppapi::PdfAccessibilityTextFieldInfo text_feild;
+    text_feild.text_run_index = 1;
+    text_feild.index_in_page = 1;
+    page_objects.form_fields.text_fields.push_back(std::move(text_feild));
+  }
+
+  EXPECT_FALSE(PdfAccessibilityTree::IsDataFromPluginValid(text_runs, chars,
+                                                           page_objects));
+}
+
+TEST(PdfAccessibilityTreeUnitTest, OutOfBoundIndexInChoiceFeild) {
+  std::vector<ppapi::PdfAccessibilityTextRunInfo> text_runs;
+  text_runs.emplace_back(kFirstTextRun);
+  text_runs.emplace_back(kSecondTextRun);
+
+  std::vector<PP_PrivateAccessibilityCharInfo> chars(
+      std::begin(kDummyCharsData), std::end(kDummyCharsData));
+
+  ppapi::PdfAccessibilityPageObjects page_objects;
+
+  {
+    ppapi::PdfAccessibilityChoiceFieldInfo choice_field;
+    choice_field.text_run_index = 2;
+    choice_field.index_in_page = 1;
+    page_objects.form_fields.choice_fields.push_back(std::move(choice_field));
+  }
+  EXPECT_FALSE(PdfAccessibilityTree::IsDataFromPluginValid(text_runs, chars,
+                                                           page_objects));
+}
+
 }  // namespace pdf