diff options
author | Jun Fang <jun_fang@foxitsoftware.com> | 2015-12-09 19:20:30 -0800 |
---|---|---|
committer | Jun Fang <jun_fang@foxitsoftware.com> | 2015-12-09 19:20:30 -0800 |
commit | 2b13af09bd788afbf9e9eecc5938820cdc037134 (patch) | |
tree | 7e8901cbc0869291ac430df8ffa53522757f1461 /core/src/fxge | |
parent | 035359cd8ddb555fa33b6133db4fd405e4660712 (diff) | |
download | pdfium-2b13af09bd788afbf9e9eecc5938820cdc037134.tar.xz |
Merge to master: Fix heap-use-after-free in FT_Stream_ReleaseFrame
BUG=452793,561478
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1512873002 .
Review URL: https://codereview.chromium.org/1508343004 .
Diffstat (limited to 'core/src/fxge')
-rw-r--r-- | core/src/fxge/ge/fx_ge_fontmap.cpp | 21 | ||||
-rw-r--r-- | core/src/fxge/ge/text_int.h | 5 |
2 files changed, 18 insertions, 8 deletions
diff --git a/core/src/fxge/ge/fx_ge_fontmap.cpp b/core/src/fxge/ge/fx_ge_fontmap.cpp index 6781369455..77f9486560 100644 --- a/core/src/fxge/ge/fx_ge_fontmap.cpp +++ b/core/src/fxge/ge/fx_ge_fontmap.cpp @@ -437,10 +437,10 @@ CTTFontDesc::~CTTFontDesc() { } FX_Free(m_pFontData); } -FX_BOOL CTTFontDesc::ReleaseFace(FXFT_Face face) { +int CTTFontDesc::ReleaseFace(FXFT_Face face) { if (m_Type == 1) { if (m_SingleFace.m_pFace != face) { - return FALSE; + return -1; } } else if (m_Type == 2) { int i; @@ -449,15 +449,15 @@ FX_BOOL CTTFontDesc::ReleaseFace(FXFT_Face face) { break; } if (i == 16) { - return FALSE; + return -1; } } m_RefCount--; if (m_RefCount) { - return FALSE; + return m_RefCount; } delete this; - return TRUE; + return 0; } CFX_FontMgr::CFX_FontMgr() : m_FTLibrary(nullptr) { @@ -621,13 +621,20 @@ void CFX_FontMgr::ReleaseFace(FXFT_Face face) { if (!face) { return; } + FX_BOOL bNeedFaceDone = TRUE; auto it = m_FaceMap.begin(); while (it != m_FaceMap.end()) { auto temp = it++; - if (temp->second->ReleaseFace(face)) { + int nRet = temp->second->ReleaseFace(face); + if (nRet == -1) + continue; + bNeedFaceDone = FALSE; + if (nRet == 0) m_FaceMap.erase(temp); - } + break; } + if (bNeedFaceDone && !m_pBuiltinMapper->IsBuiltinFace(face)) + FXFT_Done_Face(face); } bool CFX_FontMgr::GetBuiltinFont(size_t index, diff --git a/core/src/fxge/ge/text_int.h b/core/src/fxge/ge/text_int.h index f17cf7f18f..1b96cfbdd2 100644 --- a/core/src/fxge/ge/text_int.h +++ b/core/src/fxge/ge/text_int.h @@ -29,7 +29,10 @@ class CTTFontDesc { m_RefCount = 0; } ~CTTFontDesc(); - FX_BOOL ReleaseFace(FXFT_Face face); + // ret < 0, releaseface not appropriate for this object. + // ret == 0, object released + // ret > 0, object still alive, other referrers. + int ReleaseFace(FXFT_Face face); int m_Type; union { struct { |