From ef72d48bc190017cc4181135b6593357ccc7d977 Mon Sep 17 00:00:00 2001 From: Jun Fang Date: Tue, 5 Aug 2014 04:32:48 -0700 Subject: Fix the problem that memory is accessed after released due to invalid type-cast BUG=387774 R=palmer@chromium.org, tsepez@chromium.org Review URL: https://codereview.chromium.org/441503003 --- core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) (limited to 'core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp') diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp index af3fcc7094..e0fd3bfaee 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp @@ -1126,19 +1126,19 @@ CPDF_Array* CPDF_Parser::GetIDArray() } FX_DWORD CPDF_Parser::GetRootObjNum() { - CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL; + CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL; if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) { return 0; } - return pRef->GetRefObjNum(); + return ((CPDF_Reference*) pRef)->GetRefObjNum(); } FX_DWORD CPDF_Parser::GetInfoObjNum() { - CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL; + CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL; if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) { return 0; } - return pRef->GetRefObjNum(); + return ((CPDF_Reference*) pRef)->GetRefObjNum(); } FX_BOOL CPDF_Parser::IsFormStream(FX_DWORD objnum, FX_BOOL& bForm) { @@ -1592,9 +1592,9 @@ FX_DWORD CPDF_Parser::StartAsynParse(IFX_FileRead* pFileAccess, FX_BOOL bReParse } } if (m_pSecurityHandler && m_pSecurityHandler->IsMetadataEncrypted()) { - CPDF_Reference* pMetadata = (CPDF_Reference*)m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata")); + CPDF_Object* pMetadata = m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata")); if (pMetadata && pMetadata->GetType() == PDFOBJ_REFERENCE) { - m_Syntax.m_MetadataObjnum = pMetadata->GetRefObjNum(); + m_Syntax.m_MetadataObjnum = ((CPDF_Reference*) pMetadata)->GetRefObjNum(); } } return PDFPARSE_ERROR_SUCCESS; @@ -3319,8 +3319,10 @@ FX_BOOL CPDF_DataAvail::GetPageKids(CPDF_Parser *pParser, CPDF_Object *pPages) case PDFOBJ_ARRAY: { CPDF_Array *pKidsArray = (CPDF_Array *)pKids; for (FX_DWORD i = 0; i < pKidsArray->GetCount(); ++i) { - CPDF_Reference *pKid = (CPDF_Reference *)pKidsArray->GetElement(i); - m_PageObjList.Add(pKid->GetRefObjNum()); + CPDF_Object *pKid = (CPDF_Object *)pKidsArray->GetElement(i); + if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) { + m_PageObjList.Add(((CPDF_Reference *)pKid)->GetRefObjNum()); + } } } break; -- cgit v1.2.3