Age | Commit message (Collapse) | Author |
|
Review-Url: https://codereview.chromium.org/2357173005
|
|
The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t, m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx >= m_dwWeightTablesSize)|
in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ? &pWeight->m_Weights[idx] : nullptr|
in function CWeightTable::GetValueFromPixelWeight() were insufficient.
This CL strengthens bounds check for accessing int type array PixelWeight.m_Weights.
BUG=chromium:619398
R=ochang@chromium.org, thestig@chromium.org
Review-Url: https://codereview.chromium.org/2322903002
|
|
found by libfuzzer
Review-Url: https://codereview.chromium.org/2366143002
|
|
In all cases, bool can be used instead without problems.
Review-Url: https://codereview.chromium.org/2368693002
|
|
Remove C-casts, nits.
Review-Url: https://codereview.chromium.org/2367743003
|
|
The change at 5b7c9bb differed from the original code in
that a pre-existing object would now be freed, which showed
that a collision could be possible if m_LastObjNum overflowed.
BUG=649206
Review-Url: https://codereview.chromium.org/2361303002
|
|
BUG=648935,649436
Review-Url: https://codereview.chromium.org/2360283004
|
|
Review-Url: https://codereview.chromium.org/2364643003
|
|
Specialize default_delete to avoid having to say
ReleaseDeleter<CPDF_ColorSpace> throughout the code.
Review-Url: https://codereview.chromium.org/2368433003
|
|
This better describes its purpose, and reduces confusion
with the CFX_CountRef class, which is unrelated.
The WeakPtr class itself that manipulates handles is NYI.
Review-Url: https://codereview.chromium.org/2366673003
|
|
This gives additional protection in case of re-entry. Also
make CFX_CountRef more robust in face of errors.
BUG=649229
Review-Url: https://codereview.chromium.org/2364673002
|
|
Also, it's idempotent, so simplify some logic in callers to
not care if objnum is zero.
The alternate forms are rarely used, using the objnum form
makes it clear that SetReferenceFor() can't possibly register
the object as a side-effect.
Review-Url: https://codereview.chromium.org/2361713002
|
|
Review-Url: https://codereview.chromium.org/2358243002
|
|
The old SetParam() method had "maybe take ownership" semanitcs
based upon the type argument.
Make GetParam() handle the None case and simplify callers
based upon that behaviour.
Review-Url: https://codereview.chromium.org/2358043003
|
|
Given a large enough value for the character code it's possible to overflow
the conversion to an int. This Cl updates the code to guard against overflow.
BUG=chromium:648739
Review-Url: https://codereview.chromium.org/2358023002
|
|
Review-Url: https://codereview.chromium.org/2353383002
|
|
Review-Url: https://codereview.chromium.org/2356603003
|
|
and in CPDF_CMapParser
Review-Url: https://codereview.chromium.org/2353963003
|
|
Review-Url: https://codereview.chromium.org/2353143002
|
|
We remove the indirect object holder argument and check that
call sites pass ownable objects, adding a reference in one
place that always was passing an indirect object.
Also check that the invariant isn't violated, we need to fail
here in the wild and investigate -- these are existing UAFs.
Review-Url: https://codereview.chromium.org/2355083002
|
|
Remove CPDF_Creator and CPDF_Parser as friends of CPDF_Document. Move all
member variables to the private section, and add CPDF_TestDocument as a
private friend.
Review-Url: https://codereview.chromium.org/2349353003
|
|
Remove friendship as there doesn't appear to be anything protected that is
being accessed by CPDF_OCContext.
Review-Url: https://codereview.chromium.org/2355823002
|
|
Remove the friendship between these two classes and replace with accessor
methods.
Review-Url: https://codereview.chromium.org/2355813002
|
|
This CL renames and cleans up some methods that are similar between
CPDF_Document and CPDFXFA_Document.
Review-Url: https://codereview.chromium.org/2351673004
|
|
This reverts commit 81e1e3fd2d33478733e47bd007b76fac1a663e74.
Review-Url: https://codereview.chromium.org/2353013003
|
|
BUG=79367, 48791
The fonts was not cleared after unloading pages.
Test pdf: http://www.nasa.gov/pdf/750614main_NASA_FY_2014_Budget_Estimates-508.pdf
For this file, we have ~5 fonts per page, which equal ~1 Mb per page.
In this PDF we have 670 pages, as result after slow scrolling(reading) full document we have ~600 Mb fonts data in memory.
Memory usage of PDF Plugin:
before this CL: ~660 Mb
after this CL: ~100 Mb
This is last part of reverted CL:
Original CL: https://codereview.chromium.org/2158023002
Revert reason: BUG=647612
Fix bug CL: https://codereview.chromium.org/2350193003
Previous CL: https://codereview.chromium.org/2350243002
Review-Url: https://codereview.chromium.org/2351193002
|
|
Upon indirect object holder destruction, all indirect
objects are destroyed -- currently by order of increasing
object number -- but ideally without ordering constraints.
So currently, we can get away with a dictionary pointing
directly at an indirect object with a higher number. It
gets destroyed first, invoking Release() on its subordinates,
which skips destroying them if they are indirect objects. But
we don't want to rely on this artifact of destruction
order. Should it happen to be reversed, the dictionary
would invoke Release() on freed memory.
Interestingly, CPDF_Array skirts the issue by replacing
any indirect objects it is given with references. Not
clear whether we should do the same thing for dictionaries,
or remove it from arrays. The technique certainly
complicates understanding ownership.
The one violation found is in the unittest that broke the
previous CL which tried to use unique_ptrs in indirect
object holder.
Review-Url: https://codereview.chromium.org/2353093002
|
|
After this CL: only one global CFX_FontCache used. Any cached items
from it, are released, when they are not being used.
This is restore part of reverted CL:
Original CL: https://codereview.chromium.org/2158023002
Revert reason: BUG=647612
Fix bug CL: https://codereview.chromium.org/2350193003
Review-Url: https://codereview.chromium.org/2350243002
|
|
BUG=645954
Review-Url: https://codereview.chromium.org/2355733002
|
|
BUG=648059
Review-Url: https://codereview.chromium.org/2350013003
|
|
This reverts commit c8544d634a1993e2592e41458be215fcd0956031.
TBR=dsinclair@chromium.org
Review URL: https://codereview.chromium.org/2355683002 .
|
|
The objects it is given are owned by it and are simply
deleted without regard to Release() used by others.
Review-Url: https://codereview.chromium.org/2350263002
|
|
We can delete this just fine on our own.
Review-Url: https://codereview.chromium.org/2355593002
|
|
BUG=647612
Review-Url: https://codereview.chromium.org/2350193003
|
|
Replace the CPDF_Stream(nullptr, 0, nullptr) pattern with
a default ctor.
Remove unused parameters from CPDF_Stream::SetData(). Both
are always passed as FALSE.
CPDF_Stream declared its own m_GenNum, which shadowed the one
in CPDF_Object. It was used only to distinguish file/memory
streams, so add a bool explicitly for this purpose.
Remove the union, it would be sad if we confused user data
with a C++ object with virtual function calls.
Use unique_ptrs with appropriate deleters to manage memory.
Review-Url: https://codereview.chromium.org/2347993002
|
|
TEST=build pdfium and chromium
BUG=pdfium:599
Review-Url: https://codereview.chromium.org/2355523002
|
|
https://codereview.chromium.org/2158023002/ )
Reason for revert:
Causes heap-use-after-free. See crbug.com/647612.
Original issue's description:
> Fix memory leaking on ClosePage.
> CFX_FontCache refactoring:
> after this CL: Only one global CFX_FontCache used. Any cached items from it, are released, when its are not used.
>
> BUG=79367,48791
>
> The fonts was not cleared after unloading pages.
>
> Test pdf:
>
> http://www.nasa.gov/pdf/750614main_NASA_FY_2014_Budget_Estimates-508.pdf
>
> For this file, we have ~5 fonts per page, which equal ~1 Mb per page.
> In this PDF we have 670 pages, as result after slow scrolling(reading) full document we have ~600 Mb fonts data in memory.
>
> memory usage of PDF Plugin:
> before this CL: ~660 Mb
> after this CL: ~100 Mb
>
> Committed: https://pdfium.googlesource.com/pdfium/+/cde5101eb15b24519e89fa500fe37038bc8e2201
TBR=tsepez@chromium.org,brucedawson@chromium.org,npm@chromium.org,art-snake@yandex-team.ru
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=79367,48791
Review-Url: https://codereview.chromium.org/2350763002
|
|
PWL_FontMap does not need its own charset definitions. fx_edit.h does
not need to define DEFAULT_CHARSET. XFA have their own definitions.
They look different in that most are MAC or MSWin charset definitions.
So they are left untouched. public/fpdf_sysfontinfo.h duplicate ones
were left untouched due to being in public folder.
Review-Url: https://codereview.chromium.org/2347313002
|
|
CPDF_ImageRenderer::StartDIBSource.
Correct the compare logic in CPDF_ImageRenderer::StartDIBSource() by using size_t instead of int.
BUG=chromium:645036
R=ochang@chromium.org
Review-Url: https://codereview.chromium.org/2323663002
|
|
BUG=648127
Review-Url: https://codereview.chromium.org/2351623002
|
|
ProcessbCJK and CalculateFontDesc methods are used to reduce the code
duplication between AddFont and AddWindowsFont methods.
Review-Url: https://codereview.chromium.org/2341373003
|
|
CFX_FontCache refactoring:
after this CL: Only one global CFX_FontCache used. Any cached items from it, are released, when its are not used.
BUG=79367,48791
The fonts was not cleared after unloading pages.
Test pdf:
http://www.nasa.gov/pdf/750614main_NASA_FY_2014_Budget_Estimates-508.pdf
For this file, we have ~5 fonts per page, which equal ~1 Mb per page.
In this PDF we have 670 pages, as result after slow scrolling(reading) full document we have ~600 Mb fonts data in memory.
memory usage of PDF Plugin:
before this CL: ~660 Mb
after this CL: ~100 Mb
Review-Url: https://codereview.chromium.org/2158023002
|
|
Adds string hashes so CFX strings will interoperate with
STL unordered containers.
These will be employed per-document in a subsequent cl.
BUG=pdfium:597
Review-Url: https://codereview.chromium.org/2341683005
|
|
On Acrobat, if "/AP" is present on a text markup definition,
the coordinates used to draw the annotation come from "/Rect
values, whereas if "/AP" is not defined, the array defined
in /QuadPoints is used to grab the annotation coordinates from.
PDFium, on the other hand, uses "/Rect" regardless of
presence or absence of "/AP".
CL fixes PDFium to work similarly to Acrobat, in this case.
TEST=testing/resources/pixel/bug_585_*.in
BUG=pdfium:585
Review-Url: https://codereview.chromium.org/2289293005
|
|
CPDF_Font::UnicodeFromCharcode returns 0 only if ToUnicode map maps the
charcode to 0. CPDF_SimpleFont::UnicodeFromCharcode and CPDF_CID_Font::
UnicodeFromCharCode return 0 only if the call to CPDF_Font returns 0.
In other cases, these methods return an empty string. So when
processing text, a 0 return from the method should not be replaced
with the charcode.
BUG=pdfium:583
Review-Url: https://codereview.chromium.org/2342073002
|
|
Strings are never less than themselves, and this will occur given
the shared CoW nature of these strings.
Review-Url: https://codereview.chromium.org/2347433004
|
|
This Cl makes the Get and Set methods consistenly use {G|S}et<Type>For.
BUG=pdfium:596
Review-Url: https://codereview.chromium.org/2334323005
|
|
Deleted parameter from callers, who also do not use it.
Review-Url: https://codereview.chromium.org/2337973004
|
|
CFX_FaceCache::LookUpGlyphBitMap should remember its unsuccessful glyph
bitmap calculations. This is especially important if there are a lot of
repeated requests for the same glyph with large bitmaps (which means
long calculations in freetype). With this CL, the pdf in the bug below
will be rendered quickly.
BUG=chromium:638856
Review-Url: https://codereview.chromium.org/2338883004
|
|
Remove unused params and methods. Cleanup formatting.
Review-Url: https://codereview.chromium.org/2322003002
|