Fix the problem that memory is accessed after released due to invalid type-cast

BUG=387774
R=palmer@chromium.org, tsepez@chromium.org

Review URL: https://codereview.chromium.org/441503003

3 files changed, 22 insertions, 14 deletions

diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp
index cd100a80cc..635fc6b0ee 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp
@@ -192,9 +192,9 @@ int CPDF_Document::_FindPageIndex(CPDF_Dictionary* pNode, FX_DWORD& skip_count,
         }
         if (count && count == pKidList->GetCount()) {
             for (FX_DWORD i = 0; i < count; i ++) {
-                CPDF_Reference* pKid = (CPDF_Reference*)pKidList->GetElement(i);
+                CPDF_Object* pKid = pKidList->GetElement(i);
                 if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) {
-                    if (pKid->GetRefObjNum() == objnum) {
+                    if (((CPDF_Reference*) pKid)->GetRefObjNum() == objnum) {
                         m_PageList.SetAt(index + i, objnum);
                         return index + i;
                     }
@@ -345,8 +345,11 @@ FX_BOOL CPDF_Document::IsContentUsedElsewhere(FX_DWORD objnum, CPDF_Dictionary*
         if (pContents->GetDirectType() == PDFOBJ_ARRAY) {
             CPDF_Array* pArray = (CPDF_Array*)pContents->GetDirect();
             for (FX_DWORD j = 0; j < pArray->GetCount(); j ++) {
-                CPDF_Reference* pRef = (CPDF_Reference*)pArray->GetElement(j);
-                if (pRef->GetRefObjNum() == objnum) {
+                CPDF_Object* pRef = pArray->GetElement(j);
+                if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) {
+                    continue;
+                }
+                if (((CPDF_Reference*) pRef)->GetRefObjNum() == objnum) {
                     return TRUE;
                 }
             }
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index af3fcc7094..e0fd3bfaee 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1126,19 +1126,19 @@ CPDF_Array* CPDF_Parser::GetIDArray()
 }
 FX_DWORD CPDF_Parser::GetRootObjNum()
 {
-    CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL;
+    CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL;
     if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) {
         return 0;
     }
-    return pRef->GetRefObjNum();
+    return ((CPDF_Reference*) pRef)->GetRefObjNum();
 }
 FX_DWORD CPDF_Parser::GetInfoObjNum()
 {
-    CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL;
+    CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL;
     if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) {
         return 0;
     }
-    return pRef->GetRefObjNum();
+    return ((CPDF_Reference*) pRef)->GetRefObjNum();
 }
 FX_BOOL CPDF_Parser::IsFormStream(FX_DWORD objnum, FX_BOOL& bForm)
 {
@@ -1592,9 +1592,9 @@ FX_DWORD CPDF_Parser::StartAsynParse(IFX_FileRead* pFileAccess, FX_BOOL bReParse
         }
     }
     if (m_pSecurityHandler && m_pSecurityHandler->IsMetadataEncrypted()) {
-        CPDF_Reference* pMetadata = (CPDF_Reference*)m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata"));
+        CPDF_Object* pMetadata = m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata"));
         if (pMetadata && pMetadata->GetType() == PDFOBJ_REFERENCE) {
-            m_Syntax.m_MetadataObjnum = pMetadata->GetRefObjNum();
+            m_Syntax.m_MetadataObjnum = ((CPDF_Reference*) pMetadata)->GetRefObjNum();
         }
     }
     return PDFPARSE_ERROR_SUCCESS;
@@ -3319,8 +3319,10 @@ FX_BOOL CPDF_DataAvail::GetPageKids(CPDF_Parser *pParser, CPDF_Object *pPages)
         case PDFOBJ_ARRAY: {
                 CPDF_Array *pKidsArray = (CPDF_Array *)pKids;
                 for (FX_DWORD i = 0; i < pKidsArray->GetCount(); ++i) {
-                    CPDF_Reference *pKid = (CPDF_Reference *)pKidsArray->GetElement(i);
-                    m_PageObjList.Add(pKid->GetRefObjNum());
+                    CPDF_Object *pKid = (CPDF_Object *)pKidsArray->GetElement(i);
+                    if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) {
+                        m_PageObjList.Add(((CPDF_Reference *)pKid)->GetRefObjNum());
+                    }
                 }
             }
             break;
diff --git a/core/src/fpdfdoc/doc_tagged.cpp b/core/src/fpdfdoc/doc_tagged.cpp
index 551042037b..698157356c 100644
--- a/core/src/fpdfdoc/doc_tagged.cpp
+++ b/core/src/fpdfdoc/doc_tagged.cpp
@@ -192,8 +192,11 @@ FX_BOOL CPDF_StructTreeImpl::AddTopLevelNode(CPDF_Dictionary* pDict, CPDF_Struct
         FX_DWORD i;
         FX_BOOL bSave = FALSE;
         for (i = 0; i < pTopKids->GetCount(); i ++) {
-            CPDF_Reference* pKidRef = (CPDF_Reference*)pTopKids->GetElement(i);
-            if (pKidRef->GetType() != PDFOBJ_REFERENCE || pKidRef->GetRefObjNum() != pDict->GetObjNum()) {
+            CPDF_Object* pKidRef = pTopKids->GetElement(i);
+            if (pKidRef == NULL || pKidRef->GetType() != PDFOBJ_REFERENCE) {
+                continue;
+            }
+            if (((CPDF_Reference*) pKidRef)->GetRefObjNum() != pDict->GetObjNum()) {
                 continue;
             }
             if (m_Kids[i]) {