summaryrefslogtreecommitdiff
path: root/xfa
diff options
context:
space:
mode:
authorJun Fang <jun_fang@foxitsoftware.com>2016-02-23 09:36:10 +0800
committerJun Fang <jun_fang@foxitsoftware.com>2016-02-23 09:36:10 +0800
commit2c115d829d3560fd5082500c552dfe38850881ec (patch)
treed639f60563bcaa6727b9f32fe740d95270919056 /xfa
parent4f4de9a14eed86bb49340079b9bd43ed7a3caf70 (diff)
downloadpdfium-2c115d829d3560fd5082500c552dfe38850881ec.tar.xz
Resolve heap-use-after-free in CFX_WideString::~CFX_WideString()
BUG=pdfium:402 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1719803002 .
Diffstat (limited to 'xfa')
-rw-r--r--xfa/include/fwl/lightwidget/listbox.h2
-rw-r--r--xfa/src/fwl/src/lightwidget/listbox.cpp10
2 files changed, 2 insertions, 10 deletions
diff --git a/xfa/include/fwl/lightwidget/listbox.h b/xfa/include/fwl/lightwidget/listbox.h
index 09bc018a63..b30f0f6739 100644
--- a/xfa/include/fwl/lightwidget/listbox.h
+++ b/xfa/include/fwl/lightwidget/listbox.h
@@ -26,7 +26,7 @@ class CFWL_ListBox : public CFWL_Widget {
FWL_HLISTITEM AddString(const CFX_WideStringC& wsAdd,
FX_BOOL bSelect = FALSE);
FX_BOOL DeleteString(FWL_HLISTITEM hItem);
- FX_BOOL DeleteAll();
+ void DeleteAll();
int32_t CountSelItems();
FWL_HLISTITEM GetSelItem(int32_t nIndexSel);
int32_t GetSelIndex(int32_t nIndex);
diff --git a/xfa/src/fwl/src/lightwidget/listbox.cpp b/xfa/src/fwl/src/lightwidget/listbox.cpp
index 62e25cc36d..eb212fadca 100644
--- a/xfa/src/fwl/src/lightwidget/listbox.cpp
+++ b/xfa/src/fwl/src/lightwidget/listbox.cpp
@@ -63,18 +63,10 @@ FX_BOOL CFWL_ListBox::DeleteString(FWL_HLISTITEM hItem) {
pSel->m_dwStates |= FWL_ITEMSTATE_LTB_Selected;
}
m_ListBoxDP.m_ItemArray.erase(m_ListBoxDP.m_ItemArray.begin() + nIndex);
- delete pDelItem;
return TRUE;
}
-FX_BOOL CFWL_ListBox::DeleteAll() {
- size_t iCount = m_ListBoxDP.CountItems(m_pIface);
- for (size_t i = 0; i < iCount; ++i) {
- CFWL_ListItem* pItem =
- reinterpret_cast<CFWL_ListItem*>(m_ListBoxDP.GetItem(m_pIface, i));
- delete pItem;
- }
+void CFWL_ListBox::DeleteAll() {
m_ListBoxDP.m_ItemArray.clear();
- return TRUE;
}
int32_t CFWL_ListBox::CountSelItems() {
if (!m_pIface)