summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJun Fang <jun_fang@foxitsoftware.com>2016-02-05 21:48:00 -0800
committerJun Fang <jun_fang@foxitsoftware.com>2016-02-05 21:48:00 -0800
commit22e659117f4302718e5bb82f7c74251bf032be4d (patch)
treef403bbdf683696f8f1a656e3268e6ee91ca00803
parent2f6ed155a5cd0938cd298bf30b9ca28e610843ba (diff)
downloadpdfium-22e659117f4302718e5bb82f7c74251bf032be4d.tar.xz
Fix heap-use-after-free in CXFA_FFWidget::GetDataAcc()
BUG=pdfium:386 R=thestig@chromium.org Review URL: https://codereview.chromium.org/1680463002 .
-rw-r--r--xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp1
1 files changed, 1 insertions, 0 deletions
diff --git a/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp b/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
index 8e0a9444c5..855483bbae 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
@@ -52,6 +52,7 @@ void XFA_ReleaseLayoutItem(CXFA_LayoutItem* pLayoutItem) {
XFA_ReleaseLayoutItem(pNode);
pNode = pNext;
}
+ pNotify->OnLayoutEvent(pDocLayout, pLayoutItem, XFA_LAYOUTEVENT_ItemRemoving);
if (pLayoutItem->m_pFormNode->GetClassID() == XFA_ELEMENT_PageArea) {
pNotify->OnPageEvent(static_cast<CXFA_ContainerLayoutItem*>(pLayoutItem),
XFA_PAGEEVENT_PageRemoved);