Fix destruction order with CPDF_StreamAcc.

Commit d39389f6 changed CPDF_StreamAcc to use MaybeOwned, so now callers
have to destroy it more carefully, so CPDF_StreamAcc does not end up
with a dangling pointer.

BUG=chromium:887626

Change-Id: Id5e7af96aad6270c444485c1574182da5dbd9ebf
Reviewed-on: https://pdfium-review.googlesource.com/42893
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

1 files changed, 8 insertions, 6 deletions

diff --git a/fpdfsdk/fpdf_ppo.cpp b/fpdfsdk/fpdf_ppo.cpp
index 6313e43f29..4e47a00694 100644
--- a/fpdfsdk/fpdf_ppo.cpp
+++ b/fpdfsdk/fpdf_ppo.cpp
@@ -711,16 +711,18 @@ uint32_t CPDF_NPageToOneExporter::MakeXObject(
       const CPDF_Stream* pStream = pSrcContentArray->GetStreamAt(i);
       auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
       pAcc->LoadAllDataFiltered();
-      ByteString bsStream(pAcc->GetData(), pAcc->GetSize());
-      bsSrcContentStream += bsStream;
+      bsSrcContentStream += ByteString(pAcc->GetData(), pAcc->GetSize());
       bsSrcContentStream += "\n";
     }
     pNewXObject->SetDataAndRemoveFilter(bsSrcContentStream.AsRawSpan());
   } else {
-    const CPDF_Stream* pStream = pSrcContentObj->AsStream();
-    auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
-    pAcc->LoadAllDataFiltered();
-    ByteString bsStream(pAcc->GetData(), pAcc->GetSize());
+    ByteString bsStream;
+    {
+      const CPDF_Stream* pStream = pSrcContentObj->AsStream();
+      auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
+      pAcc->LoadAllDataFiltered();
+      bsStream = ByteString(pAcc->GetData(), pAcc->GetSize());
+    }
     pNewXObject->SetDataAndRemoveFilter(bsStream.AsRawSpan());
   }
   return pNewXObject->GetObjNum();