5 files changed, 17 insertions, 12 deletions
diff --git a/core/fpdfapi/parser/cpdf_document.h b/core/fpdfapi/parser/cpdf_document.h
index f7fb6308c1..493c1edb32 100644
--- a/core/fpdfapi/parser/cpdf_document.h
+++ b/core/fpdfapi/parser/cpdf_document.h
@@ -50,7 +50,7 @@ class CPDF_Document : public CPDF_IndirectObjectHolder {
 
   CPDF_Parser* GetParser() const { return m_pParser.get(); }
   CPDF_Dictionary* GetRoot() const { return m_pRootDict; }
-  CPDF_Dictionary* GetInfo() const { return m_pInfoDict; }
+  CPDF_Dictionary* GetInfo() const { return m_pInfoDict.Get(); }
 
   void DeletePage(int iPage);
   int GetPageCount() const;
@@ -131,13 +131,18 @@ class CPDF_Document : public CPDF_IndirectObjectHolder {
   void ResetTraversal();
 
   std::unique_ptr<CPDF_Parser> m_pParser;
-  CPDF_Dictionary* m_pRootDict;
-  CPDF_Dictionary* m_pInfoDict;
+
+  // TODO(tsepez): figure out why tests break if this is an UnownedPtr.
+  CPDF_Dictionary* m_pRootDict;  // Not owned.
+
+  CFX_UnownedPtr<CPDF_Dictionary> m_pInfoDict;
+
   // Vector of pairs to know current position in the page tree. The index in the
   // vector corresponds to the level being described. The pair contains a
   // pointer to the dictionary being processed at the level, and an index of the
   // of the child being processed within the dictionary's /Kids array.
   std::vector<std::pair<CPDF_Dictionary*, size_t>> m_pTreeTraversal;
+
   // Index of the next page that will be traversed from the page tree.
   int m_iNextPageToTraverse;
   bool m_bReachedMaxPageLevel;
diff --git a/core/fpdfapi/parser/cpdf_parser.cpp b/core/fpdfapi/parser/cpdf_parser.cpp
index 54b8ea0aa3..bf8bc7b542 100644
--- a/core/fpdfapi/parser/cpdf_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_parser.cpp
@@ -245,12 +245,12 @@ CPDF_Parser::Error CPDF_Parser::SetEncryptHandler() {
 
     std::unique_ptr<CPDF_SecurityHandler> pSecurityHandler =
         pdfium::MakeUnique<CPDF_SecurityHandler>();
-    if (!pSecurityHandler->OnInit(this, m_pEncryptDict))
+    if (!pSecurityHandler->OnInit(this, m_pEncryptDict.Get()))
       return PASSWORD_ERROR;
 
     m_pSecurityHandler = std::move(pSecurityHandler);
     auto pCryptoHandler = pdfium::MakeRetain<CPDF_CryptoHandler>();
-    if (!pCryptoHandler->Init(m_pEncryptDict, m_pSecurityHandler.get()))
+    if (!pCryptoHandler->Init(m_pEncryptDict.Get(), m_pSecurityHandler.get()))
       return HANDLER_ERROR;
     m_pSyntax->SetEncrypt(pCryptoHandler);
   }
diff --git a/core/fpdfapi/parser/cpdf_parser.h b/core/fpdfapi/parser/cpdf_parser.h
index c444c99f28..8f55ddb325 100644
--- a/core/fpdfapi/parser/cpdf_parser.h
+++ b/core/fpdfapi/parser/cpdf_parser.h
@@ -59,7 +59,7 @@ class CPDF_Parser {
   uint32_t GetInfoObjNum();
   CPDF_Array* GetIDArray();
 
-  CPDF_Dictionary* GetEncryptDict() const { return m_pEncryptDict; }
+  CPDF_Dictionary* GetEncryptDict() const { return m_pEncryptDict.Get(); }
 
   std::unique_ptr<CPDF_Object> ParseIndirectObject(
       CPDF_IndirectObjectHolder* pObjList,
@@ -156,7 +156,7 @@ class CPDF_Parser {
   bool m_bXRefStream;
   bool m_bVersionUpdated;
   int m_FileVersion;
-  CPDF_Dictionary* m_pEncryptDict;
+  CFX_UnownedPtr<CPDF_Dictionary> m_pEncryptDict;
   FX_FILESIZE m_LastXRefOffset;
   std::unique_ptr<CPDF_SecurityHandler> m_pSecurityHandler;
   CFX_ByteString m_Password;
diff --git a/core/fpdfapi/parser/cpdf_security_handler.cpp b/core/fpdfapi/parser/cpdf_security_handler.cpp
index 85a3805eea..4cdf545d63 100644
--- a/core/fpdfapi/parser/cpdf_security_handler.cpp
+++ b/core/fpdfapi/parser/cpdf_security_handler.cpp
@@ -413,7 +413,7 @@ bool CPDF_SecurityHandler::CheckUserPassword(const uint8_t* password,
                                              bool bIgnoreEncryptMeta,
                                              uint8_t* key,
                                              int32_t key_len) {
-  CalcEncryptKey(m_pEncryptDict, password, pass_size, key, key_len,
+  CalcEncryptKey(m_pEncryptDict.Get(), password, pass_size, key, key_len,
                  bIgnoreEncryptMeta, m_pParser->GetIDArray());
   CFX_ByteString ukey =
       m_pEncryptDict ? m_pEncryptDict->GetStringFor("U") : CFX_ByteString();
@@ -578,8 +578,8 @@ void CPDF_SecurityHandler::OnCreate(CPDF_Dictionary* pEncryptDict,
     pEncryptDict->SetNewFor<CPDF_String>("O", CFX_ByteString(passcode, 32),
                                          false);
   }
-  CalcEncryptKey(m_pEncryptDict, (uint8_t*)user_pass, user_size, m_EncryptKey,
-                 key_len, false, pIdArray);
+  CalcEncryptKey(m_pEncryptDict.Get(), (uint8_t*)user_pass, user_size,
+                 m_EncryptKey, key_len, false, pIdArray);
   if (m_Revision < 3) {
     uint8_t tempbuf[32];
     memcpy(tempbuf, defpasscode, 32);
diff --git a/core/fpdfapi/parser/cpdf_security_handler.h b/core/fpdfapi/parser/cpdf_security_handler.h
index 93a4e4ff61..27f7f7c610 100644
--- a/core/fpdfapi/parser/cpdf_security_handler.h
+++ b/core/fpdfapi/parser/cpdf_security_handler.h
@@ -97,8 +97,8 @@ class CPDF_SecurityHandler {
 
   int m_Version;
   int m_Revision;
-  CPDF_Parser* m_pParser;
-  CPDF_Dictionary* m_pEncryptDict;
+  CFX_UnownedPtr<CPDF_Parser> m_pParser;
+  CFX_UnownedPtr<CPDF_Dictionary> m_pEncryptDict;
   uint32_t m_Permissions;
   int m_Cipher;
   uint8_t m_EncryptKey[32];