diff options
| author | tsepez <tsepez@chromium.org> | 2016-09-20 13:23:21 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-09-20 13:23:21 -0700 |
| commit | 5a399de2945d7b244802565d8e9d2f6e662561da (patch) | |
| tree | 9c25da0dd44043f69b750a9071533596aa92c6e3 /fpdfsdk | |
| parent | 0d726c0c9931979d9b0594d56b52c861e08e09ba (diff) | |
| download | pdfium-5a399de2945d7b244802565d8e9d2f6e662561da.tar.xz | |
Make CPDF_Array not do indirect object creation.
We remove the indirect object holder argument and check that
call sites pass ownable objects, adding a reference in one
place that always was passing an indirect object.
Also check that the invariant isn't violated, we need to fail
here in the wild and investigate -- these are existing UAFs.
Review-Url: https://codereview.chromium.org/2355083002
Diffstat (limited to 'fpdfsdk')
| -rw-r--r-- | fpdfsdk/fpdfsave.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fpdfsdk/fpdfsave.cpp b/fpdfsdk/fpdfsave.cpp index 307163d1af..e5938b2542 100644 --- a/fpdfsdk/fpdfsave.cpp +++ b/fpdfsdk/fpdfsave.cpp @@ -185,10 +185,10 @@ bool SaveXFADocumentData(CPDFXFA_Document* pDocument, } else { CPDF_Stream* pData = new CPDF_Stream; pData->InitStreamFromFile(pDsfileWrite.get(), pDataDict); - pPDFDocument->AddIndirectObject(pData); + uint32_t objnum = pPDFDocument->AddIndirectObject(pData); iLast = pArray->GetCount() - 2; pArray->InsertAt(iLast, new CPDF_String("datasets", FALSE)); - pArray->InsertAt(iLast + 1, pData, pPDFDocument); + pArray->InsertAt(iLast + 1, new CPDF_Reference(pPDFDocument, objnum)); } fileList->push_back(std::move(pDsfileWrite)); } @@ -206,10 +206,10 @@ bool SaveXFADocumentData(CPDFXFA_Document* pDocument, } else { CPDF_Stream* pData = new CPDF_Stream; pData->InitStreamFromFile(pfileWrite.get(), pDataDict); - pPDFDocument->AddIndirectObject(pData); + uint32_t objnum = pPDFDocument->AddIndirectObject(pData); iLast = pArray->GetCount() - 2; pArray->InsertAt(iLast, new CPDF_String("form", FALSE)); - pArray->InsertAt(iLast + 1, pData, pPDFDocument); + pArray->InsertAt(iLast + 1, new CPDF_Reference(pPDFDocument, objnum)); } fileList->push_back(std::move(pfileWrite)); } |