summaryrefslogtreecommitdiff
path: root/xfa/fxfa/parser/cxfa_document.cpp
diff options
context:
space:
mode:
authorRyan Harrison <rharrison@chromium.org>2018-04-24 18:44:29 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-04-24 18:44:29 +0000
commit9afcfa46ee07bc22c94d49942f5a61d6a374fd2d (patch)
treeed3e030b7fabdfb4ef1182a401652f46c24f1c1f /xfa/fxfa/parser/cxfa_document.cpp
parent6453a67d84dc321a5f28728e04929dc2ff35ff88 (diff)
downloadpdfium-9afcfa46ee07bc22c94d49942f5a61d6a374fd2d.tar.xz
Switch declaration order to prevent UAF
This is occuring when the variables go out of scope, due to C++s first in, last out destruction policy. BUG=chromium:808333 Change-Id: I44f37520a22720bc23df4c8a72ff73994c37eea1 Reviewed-on: https://pdfium-review.googlesource.com/31278 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org>
Diffstat (limited to 'xfa/fxfa/parser/cxfa_document.cpp')
-rw-r--r--xfa/fxfa/parser/cxfa_document.cpp5
1 files changed, 3 insertions, 2 deletions
diff --git a/xfa/fxfa/parser/cxfa_document.cpp b/xfa/fxfa/parser/cxfa_document.cpp
index c3e73e2f19..6860c83376 100644
--- a/xfa/fxfa/parser/cxfa_document.cpp
+++ b/xfa/fxfa/parser/cxfa_document.cpp
@@ -1511,12 +1511,13 @@ void CXFA_Document::DoProtoMerge() {
}
for (CXFA_Node* pUseHrefNode : sUseNodes) {
+ // Must outlive the WideStringViews below.
+ WideString wsUseVal =
+ pUseHrefNode->JSObject()->GetCData(XFA_Attribute::Usehref);
WideStringView wsURI;
WideStringView wsID;
WideStringView wsSOM;
- WideString wsUseVal =
- pUseHrefNode->JSObject()->GetCData(XFA_Attribute::Usehref);
if (!wsUseVal.IsEmpty()) {
auto uSharpPos = wsUseVal.Find('#');
if (!uSharpPos.has_value()) {