summaryrefslogtreecommitdiff
path: root/core/fxcrt/xml
diff options
context:
space:
mode:
authorKe Liu <stackexploit@gmail.com>2018-04-19 04:11:42 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-04-19 04:11:42 +0000
commitf24afac5e17e10f70336912ff85d8cb9c783f8a8 (patch)
treee5d2d58fa249f67ba984007ac09c5b14f9021e06 /core/fxcrt/xml
parente06880f8eb984a48921f0560bd7ab4e055da432d (diff)
downloadpdfium-f24afac5e17e10f70336912ff85d8cb9c783f8a8.tar.xz
Fix UAF in CFX_XMLElement::Save
Use a ByteString object to store the returned value of WideString.UTF8Encode() instead of using a ByteStringView object to store the returned value of WideString.UTF8Encode().AsStringView(). Bug: chromium:834149 Change-Id: I8fa8dd7920140730c0417c188572d7b53e4ffb48 Reviewed-on: https://pdfium-review.googlesource.com/30890 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'core/fxcrt/xml')
-rw-r--r--core/fxcrt/xml/cfx_xmlelement.cpp6
1 files changed, 3 insertions, 3 deletions
diff --git a/core/fxcrt/xml/cfx_xmlelement.cpp b/core/fxcrt/xml/cfx_xmlelement.cpp
index cab15f24c4..5e79da63cf 100644
--- a/core/fxcrt/xml/cfx_xmlelement.cpp
+++ b/core/fxcrt/xml/cfx_xmlelement.cpp
@@ -97,10 +97,10 @@ void CFX_XMLElement::SetTextData(const WideString& wsText) {
}
void CFX_XMLElement::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
- ByteStringView name_encoded = name_.UTF8Encode().AsStringView();
+ ByteString bsNameEncoded = name_.UTF8Encode();
pXMLStream->WriteString("<");
- pXMLStream->WriteString(name_encoded);
+ pXMLStream->WriteString(bsNameEncoded.AsStringView());
for (auto it : attrs_) {
// Note, the space between attributes is added by AttributeToString which
@@ -121,7 +121,7 @@ void CFX_XMLElement::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
pChild->Save(pXMLStream);
}
pXMLStream->WriteString("</");
- pXMLStream->WriteString(name_encoded);
+ pXMLStream->WriteString(bsNameEncoded.AsStringView());
pXMLStream->WriteString(">\n");
}