From 2d55db143eb59a4267160742669304bab2ae4985 Mon Sep 17 00:00:00 2001
From: Jun Fang <jun_fang@foxitsoftware.com>
Date: Mon, 18 Aug 2014 16:39:43 -0700
Subject: Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

BUG=400996
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/477323002
---
 core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp | 147 +++++++++++++--------------
 1 file changed, 69 insertions(+), 78 deletions(-)

(limited to 'core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp')

diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
index 097bd61e6c..0b52800939 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
@@ -134,6 +134,7 @@ CPDF_DocPageData::CPDF_DocPageData(CPDF_Document *pPDFDoc)
     , m_ImageMap()
     , m_IccProfileMap()
     , m_FontFileMap()
+    , m_bForceClear(FALSE)
 {
     m_FontMap.InitHashTable(64);
     m_ColorSpaceMap.InitHashTable(32);
@@ -147,99 +148,89 @@ CPDF_DocPageData::~CPDF_DocPageData()
     Clear(FALSE);
     Clear(TRUE);
 }
-void CPDF_DocPageData::Clear(FX_BOOL bRelease)
+void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
 {
     FX_POSITION pos;
     FX_DWORD	nCount;
-    {
-        pos = m_PatternMap.GetStartPosition();
-        while (pos) {
-            CPDF_Object* ptObj;
-            CPDF_CountedObject<CPDF_Pattern*>* ptData;
-            m_PatternMap.GetNextAssoc(pos, ptObj, ptData);
-            nCount = ptData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete ptData->m_Obj;
-                ptData->m_Obj = NULL;
-            }
+
+    m_bForceClear = bForceRelease;
+    pos = m_PatternMap.GetStartPosition();
+    while (pos) {
+        CPDF_Object* ptObj;
+        CPDF_CountedObject<CPDF_Pattern*>* ptData;
+        m_PatternMap.GetNextAssoc(pos, ptObj, ptData);
+        nCount = ptData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete ptData->m_Obj;
+            ptData->m_Obj = NULL;
         }
     }
-    {
-        pos = m_FontMap.GetStartPosition();
-        while (pos) {
-            CPDF_Dictionary* fontDict;
-            CPDF_CountedObject<CPDF_Font*>* fontData;
-            m_FontMap.GetNextAssoc(pos, fontDict, fontData);
-            nCount = fontData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete fontData->m_Obj;
-                fontData->m_Obj = NULL;
-            }
+    pos = m_FontMap.GetStartPosition();
+    while (pos) {
+        CPDF_Dictionary* fontDict;
+        CPDF_CountedObject<CPDF_Font*>* fontData;
+        m_FontMap.GetNextAssoc(pos, fontDict, fontData);
+        nCount = fontData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete fontData->m_Obj;
+            fontData->m_Obj = NULL;
         }
     }
-    {
-        pos = m_ImageMap.GetStartPosition();
-        while (pos) {
-            FX_DWORD objNum;
-            CPDF_CountedObject<CPDF_Image*>* imageData;
-            m_ImageMap.GetNextAssoc(pos, objNum, imageData);
-            nCount = imageData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete imageData->m_Obj;
-                delete imageData;
-                m_ImageMap.RemoveKey(objNum);
-            }
+    pos = m_ImageMap.GetStartPosition();
+    while (pos) {
+        FX_DWORD objNum;
+        CPDF_CountedObject<CPDF_Image*>* imageData;
+        m_ImageMap.GetNextAssoc(pos, objNum, imageData);
+        nCount = imageData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete imageData->m_Obj;
+            delete imageData;
+            m_ImageMap.RemoveKey(objNum);
         }
     }
-    {
-        pos = m_ColorSpaceMap.GetStartPosition();
-        while (pos) {
-            CPDF_Object* csKey;
-            CPDF_CountedObject<CPDF_ColorSpace*>* csData;
-            m_ColorSpaceMap.GetNextAssoc(pos, csKey, csData);
-            nCount = csData->m_nCount;
-            if (bRelease || nCount < 2) {
-                csData->m_Obj->ReleaseCS();
-                csData->m_Obj = NULL;
-            }
+    pos = m_ColorSpaceMap.GetStartPosition();
+    while (pos) {
+        CPDF_Object* csKey;
+        CPDF_CountedObject<CPDF_ColorSpace*>* csData;
+        m_ColorSpaceMap.GetNextAssoc(pos, csKey, csData);
+        nCount = csData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            csData->m_Obj->ReleaseCS();
+            csData->m_Obj = NULL;
         }
     }
-    {
-        pos = m_IccProfileMap.GetStartPosition();
-        while (pos) {
-            CPDF_Stream* ipKey;
-            CPDF_CountedObject<CPDF_IccProfile*>* ipData;
-            m_IccProfileMap.GetNextAssoc(pos, ipKey, ipData);
-            nCount = ipData->m_nCount;
-            if (bRelease || nCount < 2) {
-                FX_POSITION pos2 = m_HashProfileMap.GetStartPosition();
-                while (pos2) {
-                    CFX_ByteString bsKey;
-                    CPDF_Stream* pFindStream = NULL;
-                    m_HashProfileMap.GetNextAssoc(pos2, bsKey, (void*&)pFindStream);
-                    if (ipKey == pFindStream) {
-                        m_HashProfileMap.RemoveKey(bsKey);
-                        break;
-                    }
+    pos = m_IccProfileMap.GetStartPosition();
+    while (pos) {
+        CPDF_Stream* ipKey;
+        CPDF_CountedObject<CPDF_IccProfile*>* ipData;
+        m_IccProfileMap.GetNextAssoc(pos, ipKey, ipData);
+        nCount = ipData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            FX_POSITION pos2 = m_HashProfileMap.GetStartPosition();
+            while (pos2) {
+                CFX_ByteString bsKey;
+                CPDF_Stream* pFindStream = NULL;
+                m_HashProfileMap.GetNextAssoc(pos2, bsKey, (void*&)pFindStream);
+                if (ipKey == pFindStream) {
+                    m_HashProfileMap.RemoveKey(bsKey);
+                    break;
                 }
-                delete ipData->m_Obj;
-                delete ipData;
-                m_IccProfileMap.RemoveKey(ipKey);
             }
+            delete ipData->m_Obj;
+            delete ipData;
+            m_IccProfileMap.RemoveKey(ipKey);
         }
     }
-    {
-        pos = m_FontFileMap.GetStartPosition();
-        while (pos) {
-            CPDF_Stream* ftKey;
-            CPDF_CountedObject<CPDF_StreamAcc*>* ftData;
-            m_FontFileMap.GetNextAssoc(pos, ftKey, ftData);
-            nCount = ftData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete ftData->m_Obj;
-                delete ftData;
-                m_FontFileMap.RemoveKey(ftKey);
-            }
+    pos = m_FontFileMap.GetStartPosition();
+    while (pos) {
+        CPDF_Stream* ftKey;
+        CPDF_CountedObject<CPDF_StreamAcc*>* ftData;
+        m_FontFileMap.GetNextAssoc(pos, ftKey, ftData);
+        nCount = ftData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete ftData->m_Obj;
+            delete ftData;
+            m_FontFileMap.RemoveKey(ftKey);
         }
     }
 }
-- 
cgit v1.2.3