diff options
| author | Jun Fang <jun_fang@foxitsoftware.com> | 2016-02-23 09:36:10 +0800 |
|---|---|---|
| committer | Jun Fang <jun_fang@foxitsoftware.com> | 2016-02-23 09:36:10 +0800 |
| commit | 2c115d829d3560fd5082500c552dfe38850881ec (patch) | |
| tree | d639f60563bcaa6727b9f32fe740d95270919056 | |
| parent | 4f4de9a14eed86bb49340079b9bd43ed7a3caf70 (diff) | |
| download | pdfium-2c115d829d3560fd5082500c552dfe38850881ec.tar.xz | |
Resolve heap-use-after-free in CFX_WideString::~CFX_WideString()
BUG=pdfium:402
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1719803002 .
| -rw-r--r-- | xfa/include/fwl/lightwidget/listbox.h | 2 | ||||
| -rw-r--r-- | xfa/src/fwl/src/lightwidget/listbox.cpp | 10 |
2 files changed, 2 insertions, 10 deletions
diff --git a/xfa/include/fwl/lightwidget/listbox.h b/xfa/include/fwl/lightwidget/listbox.h index 09bc018a63..b30f0f6739 100644 --- a/xfa/include/fwl/lightwidget/listbox.h +++ b/xfa/include/fwl/lightwidget/listbox.h @@ -26,7 +26,7 @@ class CFWL_ListBox : public CFWL_Widget { FWL_HLISTITEM AddString(const CFX_WideStringC& wsAdd, FX_BOOL bSelect = FALSE); FX_BOOL DeleteString(FWL_HLISTITEM hItem); - FX_BOOL DeleteAll(); + void DeleteAll(); int32_t CountSelItems(); FWL_HLISTITEM GetSelItem(int32_t nIndexSel); int32_t GetSelIndex(int32_t nIndex); diff --git a/xfa/src/fwl/src/lightwidget/listbox.cpp b/xfa/src/fwl/src/lightwidget/listbox.cpp index 62e25cc36d..eb212fadca 100644 --- a/xfa/src/fwl/src/lightwidget/listbox.cpp +++ b/xfa/src/fwl/src/lightwidget/listbox.cpp @@ -63,18 +63,10 @@ FX_BOOL CFWL_ListBox::DeleteString(FWL_HLISTITEM hItem) { pSel->m_dwStates |= FWL_ITEMSTATE_LTB_Selected; } m_ListBoxDP.m_ItemArray.erase(m_ListBoxDP.m_ItemArray.begin() + nIndex); - delete pDelItem; return TRUE; } -FX_BOOL CFWL_ListBox::DeleteAll() { - size_t iCount = m_ListBoxDP.CountItems(m_pIface); - for (size_t i = 0; i < iCount; ++i) { - CFWL_ListItem* pItem = - reinterpret_cast<CFWL_ListItem*>(m_ListBoxDP.GetItem(m_pIface, i)); - delete pItem; - } +void CFWL_ListBox::DeleteAll() { m_ListBoxDP.m_ItemArray.clear(); - return TRUE; } int32_t CFWL_ListBox::CountSelItems() { if (!m_pIface) |