Fix potential UAF in ConcatInPlace.

core/include/fxcrt/fx_string.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FX_STRING_H_
 #define _FX_STRING_H_
 
 #include <stdint.h>  // For intptr_t.
@@ skipping 371 matching lines @@
     };
 
     void                                        AllocCopy(CFX_ByteString& dest, FX_STRSIZE nCopyLen, FX_STRSIZE nCopyIndex) const;
     void                                        AssignCopy(FX_STRSIZE nSrcLen, FX_LPCSTR lpszSrcData);
     void                                        ConcatCopy(FX_STRSIZE nSrc1Len, FX_LPCSTR lpszSrc1Data, FX_STRSIZE nSrc2Len, FX_LPCSTR lpszSrc2Data);
     void                                        ConcatInPlace(FX_STRSIZE nSrcLen, FX_LPCSTR lpszSrcData);
     void                                        CopyBeforeWrite();
     void                                        AllocBeforeWrite(FX_STRSIZE nLen);
 
     StringData* m_pData;
+    friend class fxcrt_ByteStringConcatInPlace_Test;
 };
 inline CFX_ByteStringC::CFX_ByteStringC(const CFX_ByteString& src)
 {
     m_Ptr = (FX_LPCBYTE)src;
     m_Length = src.GetLength();
 }
 inline CFX_ByteStringC& CFX_ByteStringC::operator = (const CFX_ByteString& src)
 {
     m_Ptr = (FX_LPCBYTE)src;
     m_Length = src.GetLength();
@@ skipping 406 matching lines @@
     };
 
     void                    CopyBeforeWrite();
     void                    AllocBeforeWrite(FX_STRSIZE nLen);
     void                    ConcatInPlace(FX_STRSIZE nSrcLen, FX_LPCWSTR lpszSrcData);
     void                    ConcatCopy(FX_STRSIZE nSrc1Len, FX_LPCWSTR lpszSrc1Data, FX_STRSIZE nSrc2Len, FX_LPCWSTR lpszSrc2Data);
     void                    AssignCopy(FX_STRSIZE nSrcLen, FX_LPCWSTR lpszSrcData);
     void                    AllocCopy(CFX_WideString& dest, FX_STRSIZE nCopyLen, FX_STRSIZE nCopyIndex) const;
 
     StringData* m_pData;
+    friend class fxcrt_WideStringConcatInPlace_Test;
 };
 inline CFX_WideStringC::CFX_WideStringC(const CFX_WideString& src)
 {
     m_Ptr = src.c_str();
     m_Length = src.GetLength();
 }
 inline CFX_WideStringC& CFX_WideStringC::operator = (const CFX_WideString& src)
 {
     m_Ptr = src.c_str();
     m_Length = src.GetLength();
@@ skipping 66 matching lines @@
 CFX_ByteString  FX_UTF8Encode(FX_LPCWSTR pwsStr, FX_STRSIZE len);
 inline CFX_ByteString   FX_UTF8Encode(FX_WSTR wsStr)
 {
     return FX_UTF8Encode(wsStr.GetPtr(), wsStr.GetLength());
 }
 inline CFX_ByteString   FX_UTF8Encode(const CFX_WideString &wsStr)
 {
     return FX_UTF8Encode(wsStr.c_str(), wsStr.GetLength());
 }
 #endif