diff options
| author | Tom Sepez <tsepez@chromium.org> | 2017-05-22 12:26:57 -0700 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-05-22 20:25:38 +0000 |
| commit | ed75ee25f40a475f774e1e06c5375feee70b56f5 (patch) | |
| tree | cc8ebb92de480789e951047fde87b021f68d2da1 /core | |
| parent | 671630e52cda1abb5b1da71f366211cc3c95482f (diff) | |
| download | pdfium-ed75ee25f40a475f774e1e06c5375feee70b56f5.tar.xz | |
CFX_ByteStringC: avoid taking unreferenceable vector::data() ptr.chromium/3108
Otherwise, the UnownedPtr destructor will try to probe it. ASAN
knows about the structure of std::vector and will flag it as such.
Bug: 724960
Change-Id: I2b24501704c3845a4b16edad191d7b8f41f77587
Reviewed-on: https://pdfium-review.googlesource.com/5750
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Diffstat (limited to 'core')
| -rw-r--r-- | core/fxcrt/cfx_bytestring_unittest.cpp | 7 | ||||
| -rw-r--r-- | core/fxcrt/cfx_string_c_template.h | 2 | ||||
| -rw-r--r-- | core/fxcrt/cfx_widestring_unittest.cpp | 7 |
3 files changed, 15 insertions, 1 deletions
diff --git a/core/fxcrt/cfx_bytestring_unittest.cpp b/core/fxcrt/cfx_bytestring_unittest.cpp index 14d9393371..c53b90025b 100644 --- a/core/fxcrt/cfx_bytestring_unittest.cpp +++ b/core/fxcrt/cfx_bytestring_unittest.cpp @@ -786,6 +786,13 @@ TEST(fxcrt, ByteStringCFromVector) { CFX_ByteStringC lower_a_string(lower_a_vec); EXPECT_EQ(10, lower_a_string.GetLength()); EXPECT_EQ("aaaaaaaaaa", lower_a_string); + + std::vector<uint8_t> cleared_vec; + cleared_vec.push_back(42); + cleared_vec.pop_back(); + CFX_ByteStringC cleared_string(cleared_vec); + EXPECT_EQ(0, cleared_string.GetLength()); + EXPECT_EQ(nullptr, cleared_string.raw_str()); } TEST(fxcrt, ByteStringCGetID) { diff --git a/core/fxcrt/cfx_string_c_template.h b/core/fxcrt/cfx_string_c_template.h index 3a0ad74c08..89d0727b0f 100644 --- a/core/fxcrt/cfx_string_c_template.h +++ b/core/fxcrt/cfx_string_c_template.h @@ -59,8 +59,8 @@ class CFX_StringCTemplate { // Any changes to |vec| invalidate the string. explicit CFX_StringCTemplate(const std::vector<UnsignedType>& vec) { - m_Ptr = vec.data(); m_Length = pdfium::CollectionSize<FX_STRSIZE>(vec); + m_Ptr = m_Length ? vec.data() : nullptr; } CFX_StringCTemplate& operator=(const CharType* src) { diff --git a/core/fxcrt/cfx_widestring_unittest.cpp b/core/fxcrt/cfx_widestring_unittest.cpp index a9cb2d34cd..f5a0e12560 100644 --- a/core/fxcrt/cfx_widestring_unittest.cpp +++ b/core/fxcrt/cfx_widestring_unittest.cpp @@ -702,6 +702,13 @@ TEST(fxcrt, WideStringCFromVector) { CFX_WideStringC lower_a_string(lower_a_vec); EXPECT_EQ(10, lower_a_string.GetLength()); EXPECT_EQ(L"aaaaaaaaaa", lower_a_string); + + std::vector<CFX_WideStringC::UnsignedType> cleared_vec; + cleared_vec.push_back(42); + cleared_vec.pop_back(); + CFX_WideStringC cleared_string(cleared_vec); + EXPECT_EQ(0, cleared_string.GetLength()); + EXPECT_EQ(nullptr, cleared_string.raw_str()); } TEST(fxcrt, WideStringCOperatorSubscript) { |