From f24afac5e17e10f70336912ff85d8cb9c783f8a8 Mon Sep 17 00:00:00 2001 From: Ke Liu Date: Thu, 19 Apr 2018 04:11:42 +0000 Subject: Fix UAF in CFX_XMLElement::Save Use a ByteString object to store the returned value of WideString.UTF8Encode() instead of using a ByteStringView object to store the returned value of WideString.UTF8Encode().AsStringView(). Bug: chromium:834149 Change-Id: I8fa8dd7920140730c0417c188572d7b53e4ffb48 Reviewed-on: https://pdfium-review.googlesource.com/30890 Reviewed-by: dsinclair Commit-Queue: dsinclair --- core/fxcrt/xml/cfx_xmlelement.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/fxcrt/xml/cfx_xmlelement.cpp b/core/fxcrt/xml/cfx_xmlelement.cpp index cab15f24c4..5e79da63cf 100644 --- a/core/fxcrt/xml/cfx_xmlelement.cpp +++ b/core/fxcrt/xml/cfx_xmlelement.cpp @@ -97,10 +97,10 @@ void CFX_XMLElement::SetTextData(const WideString& wsText) { } void CFX_XMLElement::Save(const RetainPtr& pXMLStream) { - ByteStringView name_encoded = name_.UTF8Encode().AsStringView(); + ByteString bsNameEncoded = name_.UTF8Encode(); pXMLStream->WriteString("<"); - pXMLStream->WriteString(name_encoded); + pXMLStream->WriteString(bsNameEncoded.AsStringView()); for (auto it : attrs_) { // Note, the space between attributes is added by AttributeToString which @@ -121,7 +121,7 @@ void CFX_XMLElement::Save(const RetainPtr& pXMLStream) { pChild->Save(pXMLStream); } pXMLStream->WriteString("WriteString(name_encoded); + pXMLStream->WriteString(bsNameEncoded.AsStringView()); pXMLStream->WriteString(">\n"); } -- cgit v1.2.3