Make CPDF_PageContentGenerator methods take object numbers

This patch fixes a possibility that an owned CPDF_Stream is handed to the
indirect object holder inside RealizeResource().  Its arguments are
changed to take an object number, as is done elsewhere in the code, to
suggest that only indirect objects are acceptable.

BUG=660756

Review-Url: https://codereview.chromium.org/2489423002

6 files changed, 30 insertions, 38 deletions

diff --git a/core/fpdfapi/page/cpdf_docpagedata.cpp b/core/fpdfapi/page/cpdf_docpagedata.cpp
index c4dc050215..7c45a04af1 100644
--- a/core/fpdfapi/page/cpdf_docpagedata.cpp
+++ b/core/fpdfapi/page/cpdf_docpagedata.cpp
@@ -393,31 +393,21 @@ void CPDF_DocPageData::ReleasePattern(const CPDF_Object* pPatternObj) {
   pPattern->clear();
 }
 
-CPDF_Image* CPDF_DocPageData::GetImage(CPDF_Object* pImageStream) {
-  if (!pImageStream)
-    return nullptr;
-
-  ASSERT(!pImageStream->IsInline());
-  const uint32_t dwObjNum = pImageStream->GetObjNum();
-  auto it = m_ImageMap.find(dwObjNum);
+CPDF_Image* CPDF_DocPageData::GetImage(uint32_t dwStreamObjNum) {
+  ASSERT(dwStreamObjNum);
+  auto it = m_ImageMap.find(dwStreamObjNum);
   if (it != m_ImageMap.end())
     return it->second->AddRef();
 
   CPDF_CountedImage* pCountedImage =
-      new CPDF_CountedImage(new CPDF_Image(m_pPDFDoc, dwObjNum));
-  m_ImageMap[dwObjNum] = pCountedImage;
+      new CPDF_CountedImage(new CPDF_Image(m_pPDFDoc, dwStreamObjNum));
+  m_ImageMap[dwStreamObjNum] = pCountedImage;
   return pCountedImage->AddRef();
 }
 
-void CPDF_DocPageData::ReleaseImage(const CPDF_Object* pImageStream) {
-  if (!pImageStream)
-    return;
-
-  uint32_t dwObjNum = pImageStream->GetObjNum();
-  if (!dwObjNum)
-    return;
-
-  auto it = m_ImageMap.find(dwObjNum);
+void CPDF_DocPageData::ReleaseImage(uint32_t dwStreamObjNum) {
+  ASSERT(dwStreamObjNum);
+  auto it = m_ImageMap.find(dwStreamObjNum);
   if (it == m_ImageMap.end())
     return;
 
diff --git a/core/fpdfapi/page/cpdf_docpagedata.h b/core/fpdfapi/page/cpdf_docpagedata.h
index bf2b80498d..37538eb329 100644
--- a/core/fpdfapi/page/cpdf_docpagedata.h
+++ b/core/fpdfapi/page/cpdf_docpagedata.h
@@ -42,8 +42,8 @@ class CPDF_DocPageData {
                            bool bShading,
                            const CFX_Matrix& matrix);
   void ReleasePattern(const CPDF_Object* pPatternObj);
-  CPDF_Image* GetImage(CPDF_Object* pImageStream);
-  void ReleaseImage(const CPDF_Object* pImageStream);
+  CPDF_Image* GetImage(uint32_t dwStreamObjNum);
+  void ReleaseImage(uint32_t dwStreamObjNum);
   CPDF_IccProfile* GetIccProfile(CPDF_Stream* pIccProfileStream);
   void ReleaseIccProfile(const CPDF_IccProfile* pIccProfile);
   CPDF_StreamAcc* GetFontFileStreamAcc(CPDF_Stream* pFontStream);
diff --git a/core/fpdfapi/page/cpdf_image.cpp b/core/fpdfapi/page/cpdf_image.cpp
index 976d6d8c47..4048c9bb4e 100644
--- a/core/fpdfapi/page/cpdf_image.cpp
+++ b/core/fpdfapi/page/cpdf_image.cpp
@@ -30,9 +30,6 @@ CPDF_Image::CPDF_Image(CPDF_Document* pDoc,
     : m_pDocument(pDoc),
       m_pStream(pStream.get()),
       m_pOwnedStream(std::move(pStream)) {
-  if (!m_pStream)
-    return;
-
   m_pOwnedDict =
       ToDictionary(std::unique_ptr<CPDF_Object>(m_pStream->GetDict()->Clone()));
   m_pDict = m_pOwnedDict.get();
@@ -42,9 +39,6 @@ CPDF_Image::CPDF_Image(CPDF_Document* pDoc,
 CPDF_Image::CPDF_Image(CPDF_Document* pDoc, uint32_t dwStreamObjNum)
     : m_pDocument(pDoc),
       m_pStream(ToStream(pDoc->GetIndirectObject(dwStreamObjNum))) {
-  if (!m_pStream)
-    return;
-
   m_pDict = m_pStream->GetDict();
   FinishInitialization();
 }
@@ -79,6 +73,14 @@ CPDF_Image* CPDF_Image::Clone() {
   return pImage;
 }
 
+void CPDF_Image::ConvertStreamToIndirectObject() {
+  if (!m_pStream->IsInline())
+    return;
+
+  ASSERT(m_pOwnedStream);
+  m_pDocument->AddIndirectObject(m_pOwnedStream.release());
+}
+
 CPDF_Dictionary* CPDF_Image::InitJPEG(uint8_t* pData, uint32_t size) {
   int32_t width;
   int32_t height;
@@ -122,8 +124,10 @@ CPDF_Dictionary* CPDF_Image::InitJPEG(uint8_t* pData, uint32_t size) {
   m_bIsMask = false;
   m_Width = width;
   m_Height = height;
-  if (!m_pStream)
-    m_pStream = new CPDF_Stream;
+  if (!m_pStream) {
+    m_pOwnedStream = pdfium::MakeUnique<CPDF_Stream>();
+    m_pStream = m_pOwnedStream.get();
+  }
   return pDict;
 }
 
@@ -334,9 +338,10 @@ void CPDF_Image::SetImage(const CFX_DIBitmap* pBitmap, int32_t iCompress) {
       dest_offset = 0;
     }
   }
-  if (!m_pStream)
-    m_pStream = new CPDF_Stream;
-
+  if (!m_pStream) {
+    m_pOwnedStream = pdfium::MakeUnique<CPDF_Stream>();
+    m_pStream = m_pOwnedStream.get();
+  }
   m_pStream->InitStream(dest_buf, dest_size, pDict);
   m_bIsMask = pBitmap->IsAlphaMask();
   m_Width = BitmapWidth;
diff --git a/core/fpdfapi/page/cpdf_image.h b/core/fpdfapi/page/cpdf_image.h
index 02308db647..a9bcef27ad 100644
--- a/core/fpdfapi/page/cpdf_image.h
+++ b/core/fpdfapi/page/cpdf_image.h
@@ -33,6 +33,7 @@ class CPDF_Image {
   ~CPDF_Image();
 
   CPDF_Image* Clone();
+  void ConvertStreamToIndirectObject();
 
   CPDF_Dictionary* GetInlineDict() const { return m_pDict; }
   CPDF_Stream* GetStream() const { return m_pStream; }
diff --git a/core/fpdfapi/page/cpdf_imageobject.cpp b/core/fpdfapi/page/cpdf_imageobject.cpp
index c51f648b6f..2893c525b1 100644
--- a/core/fpdfapi/page/cpdf_imageobject.cpp
+++ b/core/fpdfapi/page/cpdf_imageobject.cpp
@@ -79,6 +79,6 @@ void CPDF_ImageObject::Release() {
     return;
 
   CPDF_DocPageData* pPageData = m_pImage->GetDocument()->GetPageData();
-  pPageData->ReleaseImage(m_pImage->GetStream());
+  pPageData->ReleaseImage(m_pImage->GetStream()->GetObjNum());
   m_pImage = nullptr;
 }
diff --git a/core/fpdfapi/page/cpdf_streamcontentparser.cpp b/core/fpdfapi/page/cpdf_streamcontentparser.cpp
index e7d23c0522..69b2b7e4e3 100644
--- a/core/fpdfapi/page/cpdf_streamcontentparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamcontentparser.cpp
@@ -825,12 +825,8 @@ CPDF_ImageObject* CPDF_StreamContentParser::AddImage(
 }
 
 CPDF_ImageObject* CPDF_StreamContentParser::AddImage(uint32_t streamObjNum) {
-  CPDF_Stream* pStream = ToStream(m_pDocument->GetIndirectObject(streamObjNum));
-  if (!pStream)
-    return nullptr;
-
   auto pImageObj = pdfium::MakeUnique<CPDF_ImageObject>();
-  pImageObj->SetUnownedImage(m_pDocument->LoadImageF(pStream));
+  pImageObj->SetUnownedImage(m_pDocument->LoadImageFromPageData(streamObjNum));
   return AddImageObject(std::move(pImageObj));
 }
 
@@ -840,7 +836,7 @@ CPDF_ImageObject* CPDF_StreamContentParser::AddImage(CPDF_Image* pImage) {
 
   auto pImageObj = pdfium::MakeUnique<CPDF_ImageObject>();
   pImageObj->SetUnownedImage(
-      m_pDocument->GetPageData()->GetImage(pImage->GetStream()));
+      m_pDocument->GetPageData()->GetImage(pImage->GetStream()->GetObjNum()));
 
   return AddImageObject(std::move(pImageObj));
 }