summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2018-10-13 06:39:00 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-10-13 06:39:00 +0000
commit4f5ccaaecd7e524e98b79af6823a9ab6a8753d7f (patch)
treeed7272c84725ab65a83bd94afcd8ed0ab05399ff
parent518b7f045a282e212f5d3dab0305e1ee5230365f (diff)
downloadpdfium-4f5ccaaecd7e524e98b79af6823a9ab6a8753d7f.tar.xz
Fix span / unique_ptr destruction order in PDF_DataDecode().chromium/3581chromium/3580
BUG=chromium:895026 Change-Id: Ie7d8bfd6e42308c3531ce6637ad29ec2231a2095 Reviewed-on: https://pdfium-review.googlesource.com/c/43984 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
-rw-r--r--core/fpdfapi/parser/fpdf_parser_decode.cpp4
1 files changed, 3 insertions, 1 deletions
diff --git a/core/fpdfapi/parser/fpdf_parser_decode.cpp b/core/fpdfapi/parser/fpdf_parser_decode.cpp
index 99b6154e8d..2b27b89970 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode.cpp
+++ b/core/fpdfapi/parser/fpdf_parser_decode.cpp
@@ -389,8 +389,10 @@ bool PDF_DataDecode(pdfium::span<const uint8_t> src_span,
{pDecoder->GetString(), pParams ? pParams->GetDict() : nullptr});
}
- pdfium::span<const uint8_t> last_span = src_span;
std::unique_ptr<uint8_t, FxFreeDeleter> result;
+ // May be changed to point to |result| in the for-loop below. So put it below
+ // |result| and let it get destroyed first.
+ pdfium::span<const uint8_t> last_span = src_span;
size_t nSize = DecoderArray.size();
for (size_t i = 0; i < nSize; ++i) {
int estimated_size = i == nSize - 1 ? last_estimated_size : 0;