Fix dangling reference in CFX_CodecMemory.

Do this by making CFX_CodecMemory actually own the memory that
it is ref-counting. Remove some test cases that are now prohibited,
and relax one lifetime restriction in the test because we are now
doing one additional copy (in the test, but not in real life).

Bug:879512
Change-Id: If030dfcf97fe40155c46a42288fc73192437ce9c
Reviewed-on: https://pdfium-review.googlesource.com/c/43670
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

1 files changed, 15 insertions, 30 deletions

diff --git a/core/fxcodec/gif/cfx_gifcontext_unittest.cpp b/core/fxcodec/gif/cfx_gifcontext_unittest.cpp
index 24b8acd769..9b081a4183 100644
--- a/core/fxcodec/gif/cfx_gifcontext_unittest.cpp
+++ b/core/fxcodec/gif/cfx_gifcontext_unittest.cpp
@@ -4,6 +4,8 @@
 
 #include "core/fxcodec/gif/cfx_gifcontext.h"
 
+#include <utility>
+
 #include "testing/gtest/include/gtest/gtest.h"
 
 class CFX_GifContextForTest final : public CFX_GifContext {
@@ -19,49 +21,33 @@ class CFX_GifContextForTest final : public CFX_GifContext {
 
   CFX_CodecMemory* InputBuffer() const { return input_buffer_.Get(); }
   void SetTestInputBuffer(pdfium::span<uint8_t> input) {
-    SetInputBuffer(pdfium::MakeRetain<CFX_CodecMemory>(input));
+    auto pMemory = pdfium::MakeRetain<CFX_CodecMemory>(input.size());
+    memcpy(pMemory->GetBuffer(), input.data(), input.size());
+    SetInputBuffer(std::move(pMemory));
   }
 };
 
 TEST(CFX_GifContext, SetInputBuffer) {
   uint8_t buffer[] = {0x00, 0x01, 0x02};
-  {
-    // Context must not outlive its buffers.
-    CFX_GifContextForTest context(nullptr, nullptr);
-
-    context.SetTestInputBuffer({nullptr, 0});
-    EXPECT_EQ(nullptr, context.InputBuffer()->GetBuffer());
-    EXPECT_EQ(0u, context.InputBuffer()->GetSize());
-    EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
-
-    context.SetTestInputBuffer({nullptr, 100});
-    EXPECT_EQ(nullptr, context.InputBuffer()->GetBuffer());
-    EXPECT_EQ(100u, context.InputBuffer()->GetSize());
-    EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
+  CFX_GifContextForTest context(nullptr, nullptr);
 
-    context.SetTestInputBuffer({buffer, 0});
-    EXPECT_EQ(buffer, context.InputBuffer()->GetBuffer());
-    EXPECT_EQ(0u, context.InputBuffer()->GetSize());
-    EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
+  context.SetTestInputBuffer({nullptr, 0});
+  EXPECT_EQ(0u, context.InputBuffer()->GetSize());
+  EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
 
-    context.SetTestInputBuffer({buffer, 3});
-    EXPECT_EQ(buffer, context.InputBuffer()->GetBuffer());
-    EXPECT_EQ(3u, context.InputBuffer()->GetSize());
-    EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
+  context.SetTestInputBuffer({buffer, 0});
+  EXPECT_EQ(0u, context.InputBuffer()->GetSize());
+  EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
 
-    context.SetTestInputBuffer({buffer, 100});
-    EXPECT_EQ(buffer, context.InputBuffer()->GetBuffer());
-    EXPECT_EQ(100u, context.InputBuffer()->GetSize());
-    EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
-  }
+  context.SetTestInputBuffer({buffer, 3});
+  EXPECT_EQ(3u, context.InputBuffer()->GetSize());
+  EXPECT_EQ(0u, context.InputBuffer()->GetPosition());
 }
 
 TEST(CFX_GifContext, ReadAllOrNone) {
   std::vector<uint8_t> dest_buffer;
   uint8_t src_buffer[] = {0x00, 0x01, 0x02, 0x03, 0x04,
                           0x05, 0x06, 0x07, 0x08, 0x09};
-  {
-    // Context must not outlive its buffers.
     CFX_GifContextForTest context(nullptr, nullptr);
 
     context.SetTestInputBuffer({nullptr, 0});
@@ -94,7 +80,6 @@ TEST(CFX_GifContext, ReadAllOrNone) {
       EXPECT_TRUE(context.ReadAllOrNone(dest_buffer.data(), 1));
       EXPECT_EQ(src_buffer[i], dest_buffer[0]);
     }
-  }
 }
 
 TEST(CFX_GifContext, ReadGifSignature) {