diff options
author | tsepez <tsepez@chromium.org> | 2017-01-17 11:05:57 -0800 |
---|---|---|
committer | Commit bot <commit-bot@chromium.org> | 2017-01-17 11:05:57 -0800 |
commit | 783a7e048c677d26aaf3884304627bbe27cff546 (patch) | |
tree | b03feaa32114472f54855c1b702e5bfda28d2be1 /core/fpdfapi | |
parent | b9fbe6e9af590a91ab030d2523a147e972816b32 (diff) | |
download | pdfium-783a7e048c677d26aaf3884304627bbe27cff546.tar.xz |
Avoid endless loop deleting CFGAS_GEFont.
It's a ref-counted class, so if we're in the destructor, the ref
count has hit zero. We can't make a new ref pointer to itself here,
as it will re-invoke the destructor when it goes out of scope. This
should have been an obvious anti-pattern in hindsight.
The object in question can't be in the m_pFontManager, since the font
manager retains a reference, and we wouldn't get to this destructor
while that is present. So the cleanup isn't required.
Fixing this revealed a free-delete mismatch in cxfa_textlayout.cpp.
I also converted to use unique_ptrs in a few places near this issue.
Fixing this revealed a UAF in CFGAS_GEFont, memcpy'ing a RetainPtr
is not a good idea as it doesn't bump the ref count.
Also protect and friend the CFGAS_GEFont destructor, to make sure
random deletes don't happen.
Also kill off a const cast, and remove unnecessary conversion to
retain_ptr when we already have one.
TEST=look for absence of -11 in XFA corpus test logs, bots not
currently noticing the segv. Argh.
Review-Url: https://codereview.chromium.org/2631703003
Diffstat (limited to 'core/fpdfapi')
0 files changed, 0 insertions, 0 deletions