From 4f277fc8d41303cbf007335dfbbff60b81fffde0 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Sat, 3 Oct 2015 10:06:25 -0700 Subject: Fix NULL pointer dereference in CPDF_InterForm. BUG=537772 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1387703002 . --- core/include/fpdfdoc/fpdf_doc.h | 4 ++-- core/src/fpdfdoc/doc_form.cpp | 34 ++++++++++++++++++---------------- 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/core/include/fpdfdoc/fpdf_doc.h b/core/include/fpdfdoc/fpdf_doc.h index 0588a3a914..b0c129b05e 100644 --- a/core/include/fpdfdoc/fpdf_doc.h +++ b/core/include/fpdfdoc/fpdf_doc.h @@ -738,7 +738,7 @@ class CPDF_InterForm : public CFX_PrivateData { int CompareFieldName(const CFX_ByteString& name1, const CFX_ByteString& name2); - CPDF_Document* m_pDocument; + CPDF_Document* const m_pDocument; FX_BOOL m_bGenerateAP; @@ -746,7 +746,7 @@ class CPDF_InterForm : public CFX_PrivateData { std::map m_ControlMap; - CFieldTree* m_pFieldTree; + nonstd::unique_ptr m_pFieldTree; CFX_ByteString m_bsEncoding; diff --git a/core/src/fpdfdoc/doc_form.cpp b/core/src/fpdfdoc/doc_form.cpp index 970b4b9f40..17f1808444 100644 --- a/core/src/fpdfdoc/doc_form.cpp +++ b/core/src/fpdfdoc/doc_form.cpp @@ -233,21 +233,25 @@ CFieldTree::_Node* CFieldTree::FindNode(const CFX_WideString& full_name) { return pNode; } CPDF_InterForm::CPDF_InterForm(CPDF_Document* pDocument, FX_BOOL bGenerateAP) - : CFX_PrivateData() { - m_pDocument = pDocument; - m_bGenerateAP = bGenerateAP; - m_pFormNotify = NULL; - m_bUpdated = FALSE; - m_pFieldTree = new CFieldTree; + : CFX_PrivateData(), + m_pDocument(pDocument), + m_bGenerateAP(bGenerateAP), + m_pFormDict(nullptr), + m_pFieldTree(new CFieldTree), + m_pFormNotify(nullptr), + m_bUpdated(FALSE) { CPDF_Dictionary* pRoot = m_pDocument->GetRoot(); + if (!pRoot) + return; + m_pFormDict = pRoot->GetDict("AcroForm"); - if (m_pFormDict == NULL) { + if (!m_pFormDict) return; - } + CPDF_Array* pFields = m_pFormDict->GetArray("Fields"); - if (pFields == NULL) { + if (!pFields) return; - } + int count = pFields->GetCount(); for (int i = 0; i < count; i++) { LoadField(pFields->GetDict(i)); @@ -257,12 +261,10 @@ CPDF_InterForm::CPDF_InterForm(CPDF_Document* pDocument, FX_BOOL bGenerateAP) CPDF_InterForm::~CPDF_InterForm() { for (auto it : m_ControlMap) delete it.second; - if (m_pFieldTree) { - int nCount = m_pFieldTree->m_Root.CountFields(); - for (int i = 0; i < nCount; ++i) { - delete m_pFieldTree->m_Root.GetField(i); - } - delete m_pFieldTree; + + int nCount = m_pFieldTree->m_Root.CountFields(); + for (int i = 0; i < nCount; ++i) { + delete m_pFieldTree->m_Root.GetField(i); } } -- cgit v1.2.3