diff options
| author | dsinclair <dsinclair@chromium.org> | 2016-08-23 11:39:23 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-08-23 11:39:23 -0700 |
| commit | 837735660808d52580703183ae24a3c7c7b05c7d (patch) | |
| tree | c0a607bfd0491fbf18988bf4dbe9f034571bfdf7 /fpdfsdk/include/javascript | |
| parent | c38de1116bbee807e4461fe8a08e4c152c0fce15 (diff) | |
| download | pdfium-chromium/2838.tar.xz | |
[XFA] Force destruction order of font managers.chromium/2838
The GEFont points to the font manager which creates it and tries to unregister
itself. Currently the GEFont can be created by the default mapper and then
stored in a different mapper. If the default mapper is destroyed first, when
the second mapper cleans up the font there will be a call to unregister on
the default mapper causing a use-after-free.
The long term fix is to fixup the GEFont so it points to the correct mapper
to unregister from. This CL forces the destruction order in CXFA_FFApp to
cleanup the non-default mapper first.
BUG=chromium:637546
Review-Url: https://codereview.chromium.org/2259823004
Diffstat (limited to 'fpdfsdk/include/javascript')
0 files changed, 0 insertions, 0 deletions