From 137a344ad02056107e2e01d5d55f5e97d21fa74b Mon Sep 17 00:00:00 2001
From: tsepez <tsepez@chromium.org>
Date: Mon, 14 Nov 2016 15:03:55 -0800
Subject: Make CPDF_PageContentGenerator methods take object numbers

This patch fixes a possibility that an owned CPDF_Stream is handed to the
indirect object holder inside RealizeResource().  Its arguments are
changed to take an object number, as is done elsewhere in the code, to
suggest that only indirect objects are acceptable.

BUG=660756

Review-Url: https://codereview.chromium.org/2489423002
---
 core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp | 26 +++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

(limited to 'core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp')

diff --git a/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp b/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp
index 20b4ea6eaf..c27ca044e6 100644
--- a/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp
+++ b/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp
@@ -59,8 +59,9 @@ void CPDF_PageContentGenerator::GenerateContent() {
 }
 
 CFX_ByteString CPDF_PageContentGenerator::RealizeResource(
-    CPDF_Object* pResourceObj,
+    uint32_t dwResourceObjNum,
     const CFX_ByteString& bsType) {
+  ASSERT(dwResourceObjNum);
   if (!m_pPage->m_pResources) {
     m_pPage->m_pResources =
         new CPDF_Dictionary(m_pDocument->GetByteStringPool());
@@ -82,8 +83,7 @@ CFX_ByteString CPDF_PageContentGenerator::RealizeResource(
     }
     idnum++;
   }
-  pResList->SetReferenceFor(name, m_pDocument,
-                            m_pDocument->AddIndirectObject(pResourceObj));
+  pResList->SetReferenceFor(name, m_pDocument, dwResourceObjNum);
   return name;
 }
 
@@ -104,9 +104,13 @@ void CPDF_PageContentGenerator::ProcessImage(CFX_ByteTextBuf& buf,
     return;
 
   bool bWasInline = pStream->IsInline();
-  CFX_ByteString name = RealizeResource(pStream, "XObject");
   if (bWasInline)
-    pImageObj->SetUnownedImage(m_pDocument->GetPageData()->GetImage(pStream));
+    pImage->ConvertStreamToIndirectObject();
+
+  uint32_t dwObjNum = pStream->GetObjNum();
+  CFX_ByteString name = RealizeResource(dwObjNum, "XObject");
+  if (bWasInline)
+    pImageObj->SetUnownedImage(m_pDocument->GetPageData()->GetImage(dwObjNum));
 
   buf << "/" << PDF_NameEncode(name) << " Do Q\n";
 }
@@ -118,20 +122,22 @@ void CPDF_PageContentGenerator::ProcessForm(CFX_ByteTextBuf& buf,
   if (!data || !size)
     return;
 
+  buf << "q " << matrix << " cm ";
+
+  CFX_FloatRect bbox = m_pPage->GetPageBBox();
+  matrix.TransformRect(bbox);
+
   CPDF_Dictionary* pFormDict =
       new CPDF_Dictionary(m_pDocument->GetByteStringPool());
   pFormDict->SetNameFor("Type", "XObject");
   pFormDict->SetNameFor("Subtype", "Form");
-
-  CFX_FloatRect bbox = m_pPage->GetPageBBox();
-  matrix.TransformRect(bbox);
   pFormDict->SetRectFor("BBox", bbox);
 
   CPDF_Stream* pStream = new CPDF_Stream;
   pStream->InitStream(data, size, pFormDict);
-  buf << "q " << matrix << " cm ";
 
-  CFX_ByteString name = RealizeResource(pStream, "XObject");
+  CFX_ByteString name =
+      RealizeResource(m_pDocument->AddIndirectObject(pStream), "XObject");
   buf << "/" << PDF_NameEncode(name) << " Do Q\n";
 }
 
-- 
cgit v1.2.3