From ef72d48bc190017cc4181135b6593357ccc7d977 Mon Sep 17 00:00:00 2001 From: Jun Fang Date: Tue, 5 Aug 2014 04:32:48 -0700 Subject: Fix the problem that memory is accessed after released due to invalid type-cast BUG=387774 R=palmer@chromium.org, tsepez@chromium.org Review URL: https://codereview.chromium.org/441503003 --- core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp | 11 +++++++---- core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp | 18 ++++++++++-------- core/src/fpdfdoc/doc_tagged.cpp | 7 +++++-- 3 files changed, 22 insertions(+), 14 deletions(-) (limited to 'core/src') diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp index cd100a80cc..635fc6b0ee 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp @@ -192,9 +192,9 @@ int CPDF_Document::_FindPageIndex(CPDF_Dictionary* pNode, FX_DWORD& skip_count, } if (count && count == pKidList->GetCount()) { for (FX_DWORD i = 0; i < count; i ++) { - CPDF_Reference* pKid = (CPDF_Reference*)pKidList->GetElement(i); + CPDF_Object* pKid = pKidList->GetElement(i); if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) { - if (pKid->GetRefObjNum() == objnum) { + if (((CPDF_Reference*) pKid)->GetRefObjNum() == objnum) { m_PageList.SetAt(index + i, objnum); return index + i; } @@ -345,8 +345,11 @@ FX_BOOL CPDF_Document::IsContentUsedElsewhere(FX_DWORD objnum, CPDF_Dictionary* if (pContents->GetDirectType() == PDFOBJ_ARRAY) { CPDF_Array* pArray = (CPDF_Array*)pContents->GetDirect(); for (FX_DWORD j = 0; j < pArray->GetCount(); j ++) { - CPDF_Reference* pRef = (CPDF_Reference*)pArray->GetElement(j); - if (pRef->GetRefObjNum() == objnum) { + CPDF_Object* pRef = pArray->GetElement(j); + if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) { + continue; + } + if (((CPDF_Reference*) pRef)->GetRefObjNum() == objnum) { return TRUE; } } diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp index af3fcc7094..e0fd3bfaee 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp @@ -1126,19 +1126,19 @@ CPDF_Array* CPDF_Parser::GetIDArray() } FX_DWORD CPDF_Parser::GetRootObjNum() { - CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL; + CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL; if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) { return 0; } - return pRef->GetRefObjNum(); + return ((CPDF_Reference*) pRef)->GetRefObjNum(); } FX_DWORD CPDF_Parser::GetInfoObjNum() { - CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL; + CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL; if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) { return 0; } - return pRef->GetRefObjNum(); + return ((CPDF_Reference*) pRef)->GetRefObjNum(); } FX_BOOL CPDF_Parser::IsFormStream(FX_DWORD objnum, FX_BOOL& bForm) { @@ -1592,9 +1592,9 @@ FX_DWORD CPDF_Parser::StartAsynParse(IFX_FileRead* pFileAccess, FX_BOOL bReParse } } if (m_pSecurityHandler && m_pSecurityHandler->IsMetadataEncrypted()) { - CPDF_Reference* pMetadata = (CPDF_Reference*)m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata")); + CPDF_Object* pMetadata = m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata")); if (pMetadata && pMetadata->GetType() == PDFOBJ_REFERENCE) { - m_Syntax.m_MetadataObjnum = pMetadata->GetRefObjNum(); + m_Syntax.m_MetadataObjnum = ((CPDF_Reference*) pMetadata)->GetRefObjNum(); } } return PDFPARSE_ERROR_SUCCESS; @@ -3319,8 +3319,10 @@ FX_BOOL CPDF_DataAvail::GetPageKids(CPDF_Parser *pParser, CPDF_Object *pPages) case PDFOBJ_ARRAY: { CPDF_Array *pKidsArray = (CPDF_Array *)pKids; for (FX_DWORD i = 0; i < pKidsArray->GetCount(); ++i) { - CPDF_Reference *pKid = (CPDF_Reference *)pKidsArray->GetElement(i); - m_PageObjList.Add(pKid->GetRefObjNum()); + CPDF_Object *pKid = (CPDF_Object *)pKidsArray->GetElement(i); + if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) { + m_PageObjList.Add(((CPDF_Reference *)pKid)->GetRefObjNum()); + } } } break; diff --git a/core/src/fpdfdoc/doc_tagged.cpp b/core/src/fpdfdoc/doc_tagged.cpp index 551042037b..698157356c 100644 --- a/core/src/fpdfdoc/doc_tagged.cpp +++ b/core/src/fpdfdoc/doc_tagged.cpp @@ -192,8 +192,11 @@ FX_BOOL CPDF_StructTreeImpl::AddTopLevelNode(CPDF_Dictionary* pDict, CPDF_Struct FX_DWORD i; FX_BOOL bSave = FALSE; for (i = 0; i < pTopKids->GetCount(); i ++) { - CPDF_Reference* pKidRef = (CPDF_Reference*)pTopKids->GetElement(i); - if (pKidRef->GetType() != PDFOBJ_REFERENCE || pKidRef->GetRefObjNum() != pDict->GetObjNum()) { + CPDF_Object* pKidRef = pTopKids->GetElement(i); + if (pKidRef == NULL || pKidRef->GetType() != PDFOBJ_REFERENCE) { + continue; + } + if (((CPDF_Reference*) pKidRef)->GetRefObjNum() != pDict->GetObjNum()) { continue; } if (m_Kids[i]) { -- cgit v1.2.3