From 783a7e048c677d26aaf3884304627bbe27cff546 Mon Sep 17 00:00:00 2001 From: tsepez Date: Tue, 17 Jan 2017 11:05:57 -0800 Subject: Avoid endless loop deleting CFGAS_GEFont. It's a ref-counted class, so if we're in the destructor, the ref count has hit zero. We can't make a new ref pointer to itself here, as it will re-invoke the destructor when it goes out of scope. This should have been an obvious anti-pattern in hindsight. The object in question can't be in the m_pFontManager, since the font manager retains a reference, and we wouldn't get to this destructor while that is present. So the cleanup isn't required. Fixing this revealed a free-delete mismatch in cxfa_textlayout.cpp. I also converted to use unique_ptrs in a few places near this issue. Fixing this revealed a UAF in CFGAS_GEFont, memcpy'ing a RetainPtr is not a good idea as it doesn't bump the ref count. Also protect and friend the CFGAS_GEFont destructor, to make sure random deletes don't happen. Also kill off a const cast, and remove unnecessary conversion to retain_ptr when we already have one. TEST=look for absence of -11 in XFA corpus test logs, bots not currently noticing the segv. Argh. Review-Url: https://codereview.chromium.org/2631703003 --- xfa/fxfa/app/xfa_textpiece.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'xfa/fxfa/app/xfa_textpiece.cpp') diff --git a/xfa/fxfa/app/xfa_textpiece.cpp b/xfa/fxfa/app/xfa_textpiece.cpp index 4b57aa82d9..933af6c92f 100644 --- a/xfa/fxfa/app/xfa_textpiece.cpp +++ b/xfa/fxfa/app/xfa_textpiece.cpp @@ -9,9 +9,12 @@ #include "xfa/fxfa/app/cxfa_linkuserdata.h" XFA_TextPiece::XFA_TextPiece() - : pszText(nullptr), pFont(nullptr), pLinkData(nullptr) {} + : pszText(nullptr), pWidths(nullptr), pFont(nullptr), pLinkData(nullptr) {} XFA_TextPiece::~XFA_TextPiece() { if (pLinkData) pLinkData->Release(); + + FX_Free(pszText); + FX_Free(pWidths); } -- cgit v1.2.3