From d0ecd899d632461bd6dc53e32b42bbd3a5d030ad Mon Sep 17 00:00:00 2001
From: tsepez <tsepez@chromium.org>
Date: Tue, 8 Nov 2016 17:30:04 -0800
Subject: Fix abort above FPDFPage_Flatten

Main issue: FPDFPage_Flatten trying to re-add an indirect object.

BUG=662698

Review-Url: https://codereview.chromium.org/2489653003
---
 BUILD.gn                              |  1 +
 fpdfsdk/fpdf_flatten.cpp              | 21 +++++++++---------
 fpdfsdk/fpdf_flatten_embeddertest.cpp | 40 +++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 11 deletions(-)
 create mode 100644 fpdfsdk/fpdf_flatten_embeddertest.cpp

diff --git a/BUILD.gn b/BUILD.gn
index 33d64d7c00..945b5a9a5b 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -1721,6 +1721,7 @@ test("pdfium_embeddertests") {
     "core/fxcodec/codec/fx_codec_embeddertest.cpp",
     "core/fxge/ge/fx_ge_text_embeddertest.cpp",
     "fpdfsdk/fpdf_dataavail_embeddertest.cpp",
+    "fpdfsdk/fpdf_flatten_embeddertest.cpp",
     "fpdfsdk/fpdfdoc_embeddertest.cpp",
     "fpdfsdk/fpdfedit_embeddertest.cpp",
     "fpdfsdk/fpdfext_embeddertest.cpp",
diff --git a/fpdfsdk/fpdf_flatten.cpp b/fpdfsdk/fpdf_flatten.cpp
index f7d82773e1..6cffbe0b31 100644
--- a/fpdfsdk/fpdf_flatten.cpp
+++ b/fpdfsdk/fpdf_flatten.cpp
@@ -397,8 +397,6 @@ DLLEXPORT int STDCALL FPDFPage_Flatten(FPDF_PAGE page, int nFlag) {
       continue;
 
     CPDF_Dictionary* pAPDic = pAPStream->GetDict();
-    CFX_Matrix matrix = pAPDic->GetMatrixFor("Matrix");
-
     CFX_FloatRect rcStream;
     if (pAPDic->KeyExist("Rect"))
       rcStream = pAPDic->GetRectFor("Rect");
@@ -409,13 +407,15 @@ DLLEXPORT int STDCALL FPDFPage_Flatten(FPDF_PAGE page, int nFlag) {
       continue;
 
     CPDF_Object* pObj = pAPStream;
+    if (pObj->IsInline()) {
+      pObj = pObj->Clone();
+      pDocument->AddIndirectObject(pObj);
+    }
 
-    if (pObj) {
-      CPDF_Dictionary* pObjDic = pObj->GetDict();
-      if (pObjDic) {
-        pObjDic->SetNameFor("Type", "XObject");
-        pObjDic->SetNameFor("Subtype", "Form");
-      }
+    CPDF_Dictionary* pObjDic = pObj->GetDict();
+    if (pObjDic) {
+      pObjDic->SetNameFor("Type", "XObject");
+      pObjDic->SetNameFor("Subtype", "Form");
     }
 
     CPDF_Dictionary* pXObject = pNewXORes->GetDictFor("XObject");
@@ -426,15 +426,14 @@ DLLEXPORT int STDCALL FPDFPage_Flatten(FPDF_PAGE page, int nFlag) {
 
     CFX_ByteString sFormName;
     sFormName.Format("F%d", i);
-    pXObject->SetReferenceFor(sFormName, pDocument,
-                              pDocument->AddIndirectObject(pObj));
+    pXObject->SetReferenceFor(sFormName, pDocument, pObj->GetObjNum());
 
     CPDF_StreamAcc acc;
     acc.LoadAllData(pNewXObject);
 
     const uint8_t* pData = acc.GetData();
     CFX_ByteString sStream(pData, acc.GetSize());
-
+    CFX_Matrix matrix = pAPDic->GetMatrixFor("Matrix");
     if (matrix.IsIdentity()) {
       matrix.a = 1.0f;
       matrix.b = 0.0f;
diff --git a/fpdfsdk/fpdf_flatten_embeddertest.cpp b/fpdfsdk/fpdf_flatten_embeddertest.cpp
new file mode 100644
index 0000000000..d709f59053
--- /dev/null
+++ b/fpdfsdk/fpdf_flatten_embeddertest.cpp
@@ -0,0 +1,40 @@
+// Copyright 2016 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/fxcrt/fx_basic.h"
+#include "public/fpdf_flatten.h"
+#include "public/fpdfview.h"
+#include "testing/embedder_test.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/test_support.h"
+
+namespace {
+
+class FPDFFlattenEmbeddertest : public EmbedderTest {};
+
+}  // namespace
+
+TEST_F(FPDFFlattenEmbeddertest, FlatNothing) {
+  EXPECT_TRUE(OpenDocument("hello_world.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  EXPECT_TRUE(page);
+  EXPECT_EQ(FLATTEN_NOTHINGTODO, FPDFPage_Flatten(page, FLAT_NORMALDISPLAY));
+  UnloadPage(page);
+}
+
+TEST_F(FPDFFlattenEmbeddertest, FlatNormal) {
+  EXPECT_TRUE(OpenDocument("annotiter.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  EXPECT_TRUE(page);
+  EXPECT_EQ(FLATTEN_SUCCESS, FPDFPage_Flatten(page, FLAT_NORMALDISPLAY));
+  UnloadPage(page);
+}
+
+TEST_F(FPDFFlattenEmbeddertest, FlatPrint) {
+  EXPECT_TRUE(OpenDocument("annotiter.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  EXPECT_TRUE(page);
+  EXPECT_EQ(FLATTEN_SUCCESS, FPDFPage_Flatten(page, FLAT_PRINT));
+  UnloadPage(page);
+}
-- 
cgit v1.2.3