diff options
| author | Tom Sepez <tsepez@chromium.org> | 2015-09-09 09:58:10 -0700 |
|---|---|---|
| committer | Tom Sepez <tsepez@chromium.org> | 2015-09-09 09:58:10 -0700 |
| commit | 9241e5a43990859f6f9a94aaa2c488d0451039e3 (patch) | |
| tree | d59fa133dccca79cb9b2e9da5930cae8aa6ad75e /core | |
| parent | 343dbb841f4c12e819932e2b66dd70f817337d97 (diff) | |
| download | pdfium-9241e5a43990859f6f9a94aaa2c488d0451039e3.tar.xz | |
Fix heap use after free in CPDFSDK_Annot::GetPDFAnnot.
Use two seperate loops to kill current focus annot and to release annots
in current page. Loop to kill current focus annot is run first, so it
will not access deleted annots.
BUG=507316
R=tsepez@chromium.org
TEST=Reproduction steps mentioned in issue 507316 should not crash
chrome.
Unit test added to pdfium.
Run pdfium_embeddertests.exe.
Review URL: https://codereview.chromium.org/1312313006 .
Diffstat (limited to 'core')
0 files changed, 0 insertions, 0 deletions