Fix destruction order with CPDF_StreamAcc.

Commit d39389f6 changed CPDF_StreamAcc to use MaybeOwned, so now callers
have to destroy it more carefully, so CPDF_StreamAcc does not end up
with a dangling pointer.

BUG=chromium:887626

Change-Id: Id5e7af96aad6270c444485c1574182da5dbd9ebf
Reviewed-on: https://pdfium-review.googlesource.com/42893
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

2 files changed, 14 insertions, 10 deletions

diff --git a/fpdfsdk/fpdf_flatten.cpp b/fpdfsdk/fpdf_flatten.cpp
index cca28bc300..01f3cd7e1e 100644
--- a/fpdfsdk/fpdf_flatten.cpp
+++ b/fpdfsdk/fpdf_flatten.cpp
@@ -200,11 +200,13 @@ void SetPageContents(const ByteString& key,
   pPage->ConvertToIndirectObjectFor(pdfium::page_object::kContents, pDocument);
   if (!pContentsArray) {
     pContentsArray = pDocument->NewIndirect<CPDF_Array>();
-    auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pContentsStream);
-    pAcc->LoadAllDataFiltered();
     ByteString sStream = "q\n";
-    ByteString sBody = ByteString(pAcc->GetData(), pAcc->GetSize());
-    sStream = sStream + sBody + "\nQ";
+    {
+      auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pContentsStream);
+      pAcc->LoadAllDataFiltered();
+      sStream += ByteString(pAcc->GetData(), pAcc->GetSize());
+      sStream += "\nQ";
+    }
     pContentsStream->SetDataAndRemoveFilter(sStream.AsRawSpan());
     pContentsArray->Add(pContentsStream->MakeReference(pDocument));
     pPage->SetFor(pdfium::page_object::kContents,
diff --git a/fpdfsdk/fpdf_ppo.cpp b/fpdfsdk/fpdf_ppo.cpp
index 6313e43f29..4e47a00694 100644
--- a/fpdfsdk/fpdf_ppo.cpp
+++ b/fpdfsdk/fpdf_ppo.cpp
@@ -711,16 +711,18 @@ uint32_t CPDF_NPageToOneExporter::MakeXObject(
       const CPDF_Stream* pStream = pSrcContentArray->GetStreamAt(i);
       auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
       pAcc->LoadAllDataFiltered();
-      ByteString bsStream(pAcc->GetData(), pAcc->GetSize());
-      bsSrcContentStream += bsStream;
+      bsSrcContentStream += ByteString(pAcc->GetData(), pAcc->GetSize());
       bsSrcContentStream += "\n";
     }
     pNewXObject->SetDataAndRemoveFilter(bsSrcContentStream.AsRawSpan());
   } else {
-    const CPDF_Stream* pStream = pSrcContentObj->AsStream();
-    auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
-    pAcc->LoadAllDataFiltered();
-    ByteString bsStream(pAcc->GetData(), pAcc->GetSize());
+    ByteString bsStream;
+    {
+      const CPDF_Stream* pStream = pSrcContentObj->AsStream();
+      auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
+      pAcc->LoadAllDataFiltered();
+      bsStream = ByteString(pAcc->GetData(), pAcc->GetSize());
+    }
     pNewXObject->SetDataAndRemoveFilter(bsStream.AsRawSpan());
   }
   return pNewXObject->GetObjNum();