From 396e872d872b760813036b7e7dd8bb68a8b61598 Mon Sep 17 00:00:00 2001 From: Tom Sepez Date: Wed, 9 Sep 2015 10:16:08 -0700 Subject: Merge to XFA:Fix heap use after free in CPDFSDK_Annot::GetPDFAnnot. (cherry picked from commit 9241e5a43990859f6f9a94aaa2c488d0451039e3) Original Review URL: https://codereview.chromium.org/1312313006 . (cherry picked from commit 343dbb841f4c12e819932e2b66dd70f817337d97) Original Review URL: https://codereview.chromium.org/1325533004 . BUG=507316 TBR=thestig@chromium.org Review URL: https://codereview.chromium.org/1332653002 . --- fpdfsdk/src/fsdk_mgr.cpp | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) (limited to 'fpdfsdk/src/fsdk_mgr.cpp') diff --git a/fpdfsdk/src/fsdk_mgr.cpp b/fpdfsdk/src/fsdk_mgr.cpp index 4d3d01f6f4..4a55622e57 100644 --- a/fpdfsdk/src/fsdk_mgr.cpp +++ b/fpdfsdk/src/fsdk_mgr.cpp @@ -664,15 +664,22 @@ CPDFSDK_PageView::CPDFSDK_PageView(CPDFSDK_Document* pSDKDoc, } CPDFSDK_PageView::~CPDFSDK_PageView() { + // if there is a focused annot on the page, we should kill the focus first. + if (CPDFSDK_Annot* focusedAnnot = m_pSDKDoc->GetFocusAnnot()) { + for (int i = 0, count = m_fxAnnotArray.GetSize(); i < count; i++) { + CPDFSDK_Annot* pAnnot = (CPDFSDK_Annot*)m_fxAnnotArray.GetAt(i); + if (pAnnot == focusedAnnot) { + KillFocusAnnot(); + break; + } + } + } + CPDFDoc_Environment* pEnv = m_pSDKDoc->GetEnv(); - int nAnnotCount = m_fxAnnotArray.GetSize(); - for (int i = 0; i < nAnnotCount; i++) { + CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr(); + ASSERT(pAnnotHandlerMgr); + for (int i = 0, count = m_fxAnnotArray.GetSize(); i < count; i++) { CPDFSDK_Annot* pAnnot = (CPDFSDK_Annot*)m_fxAnnotArray.GetAt(i); - // if there is a focused annot on the page, we should kill the focus first. - if (pAnnot == m_pSDKDoc->GetFocusAnnot()) - KillFocusAnnot(); - CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr(); - ASSERT(pAnnotHandlerMgr); pAnnotHandlerMgr->ReleaseAnnot(pAnnot); } m_fxAnnotArray.RemoveAll(); -- cgit v1.2.3