From 752395430376536487352815e6107c32dac7d69e Mon Sep 17 00:00:00 2001
From: Jun Fang <jun_fang@foxitsoftware.com>
Date: Wed, 20 Jan 2016 08:04:47 +0800
Subject: Fix crashing in CPDFXFA_Document::GetPage()

BUG=pdfium:332
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1539193003 .
---
 fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp | 44 +++++++++++++++++++++++--------------
 fpdfsdk/src/fsdk_mgr.cpp            | 12 ++++++++++
 2 files changed, 40 insertions(+), 16 deletions(-)

(limited to 'fpdfsdk/src')

diff --git a/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp b/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp
index 92d16b64e2..e72c1b3f16 100644
--- a/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp
+++ b/fpdfsdk/src/fpdfxfa/fpdfxfa_doc.cpp
@@ -138,29 +138,25 @@ int CPDFXFA_Document::GetPageCount() {
 }
 
 CPDFXFA_Page* CPDFXFA_Document::GetPage(int page_index) {
-  if (!m_pPDFDoc && !m_pXFADoc)
-    return NULL;
-
-  CPDFXFA_Page* pPage = NULL;
-  if (m_XFAPageList.GetSize()) {
+  if (page_index < 0)
+    return nullptr;
+  CPDFXFA_Page* pPage = nullptr;
+  int nCount = m_XFAPageList.GetSize();
+  if (nCount > 0 && page_index < nCount) {
     pPage = m_XFAPageList.GetAt(page_index);
     if (pPage)
       pPage->AddRef();
   } else {
     m_XFAPageList.SetSize(GetPageCount());
   }
-
-  if (!pPage) {
-    pPage = new CPDFXFA_Page(this, page_index);
-    FX_BOOL bRet = pPage->LoadPage();
-    if (!bRet) {
-      delete pPage;
-      return NULL;
-    }
-
-    m_XFAPageList.SetAt(page_index, pPage);
+  if (pPage)
+    return pPage;
+  pPage = new CPDFXFA_Page(this, page_index);
+  if (!pPage->LoadPage()) {
+    delete pPage;
+    return nullptr;
   }
-
+  m_XFAPageList.SetAt(page_index, pPage);
   return pPage;
 }
 
@@ -476,6 +472,22 @@ FX_BOOL CPDFXFA_Document::PopupMenu(IXFA_Widget* hWidget,
 
 void CPDFXFA_Document::PageViewEvent(IXFA_PageView* pPageView,
                                      FX_DWORD dwFlags) {
+  if (!pPageView || (dwFlags != XFA_PAGEVIEWEVENT_PostAdded &&
+                     dwFlags != XFA_PAGEVIEWEVENT_PostRemoved)) {
+    return;
+  }
+  CPDFXFA_Page* pPage = nullptr;
+  if (dwFlags == XFA_PAGEVIEWEVENT_PostAdded) {
+    pPage = GetPage(pPageView->GetPageViewIndex());
+    if (pPage)
+      pPage->SetXFAPageView(pPageView);
+    return;
+  }
+  pPage = GetPage(pPageView);
+  if (!pPage)
+    return;
+  pPage->SetXFAPageView(nullptr);
+  m_pSDKDoc->GetPageView(pPage)->ClearFXAnnots();
 }
 
 void CPDFXFA_Document::WidgetEvent(IXFA_Widget* hWidget,
diff --git a/fpdfsdk/src/fsdk_mgr.cpp b/fpdfsdk/src/fsdk_mgr.cpp
index 6d656a0c14..56f8204ce9 100644
--- a/fpdfsdk/src/fsdk_mgr.cpp
+++ b/fpdfsdk/src/fsdk_mgr.cpp
@@ -1118,6 +1118,18 @@ void CPDFSDK_PageView::LoadFXAnnots() {
   SetLock(FALSE);
 }
 
+void CPDFSDK_PageView::ClearFXAnnots() {
+  SetLock(TRUE);
+  if (m_pSDKDoc && GetFocusAnnot())
+    m_pSDKDoc->SetFocusAnnot(nullptr);
+  m_CaptureWidget = nullptr;
+  for (CPDFSDK_Annot* pAnnot : m_fxAnnotArray)
+    m_pSDKDoc->GetEnv()->GetAnnotHandlerMgr()->ReleaseAnnot(pAnnot);
+  m_fxAnnotArray.clear();
+  m_pAnnotList.reset();
+  SetLock(FALSE);
+}
+
 void CPDFSDK_PageView::UpdateRects(CFX_RectArray& rects) {
   for (int i = 0; i < rects.GetSize(); i++) {
     CPDF_Rect rc = rects.GetAt(i);
-- 
cgit v1.2.3