Merge to M44: Fix heap use after free in Document::DoFieldDelay and Document::delay

fpdfsdk/src/javascript/Document.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/javascript/JavaScript.h"
 #include "../../include/javascript/IJavaScript.h"
 #include "../../include/javascript/JS_Define.h"
 #include "../../include/javascript/JS_Object.h"
@@ skipping 970 matching lines @@
 
                 if (m_bDelay)
                 {
                         for (int i=0,sz=m_DelayData.GetSize(); i<sz; i++)
                                 delete m_DelayData.GetAt(i);
 
                         m_DelayData.RemoveAll();
                 }
                 else
                 {
-                        for (int i=0,sz=m_DelayData.GetSize(); i<sz; i++)
+                        CFX_ArrayTemplate<CJS_DelayData*> DelayDataToProcess;
+
+                        for (int i=0,sz=m_DelayData.GetSize(); i < sz; i++)
                         {
                                 if (CJS_DelayData* pData = m_DelayData.GetAt(i))
                                 {
-                                        Field::DoDelay(m_pDocument, pData);
-                                        delete m_DelayData.GetAt(i);
+                                        DelayDataToProcess.Add(pData);
+                                        m_DelayData.SetAt(i, NULL);
                                 }
                         }
                         m_DelayData.RemoveAll();
+
+                        for (int i=0,sz=DelayDataToProcess.GetSize(); i < sz; i++)
+                        {
+                                CJS_DelayData* pData = DelayDataToProcess.GetAt(i);
+                                Field::DoDelay(m_pDocument, pData);
+                                DelayDataToProcess.SetAt(i,NULL);
+                                delete pData;
+                        }
                 }
 
                 return TRUE;
         }
 }
 
 FX_BOOL Document::keywords(IFXJS_Context* cc, CJS_PropValue& vp, CFX_WideString& sError)
 {
         ASSERT(m_pDocument != NULL);
 
@@ skipping 910 matching lines @@
 }
 
 void Document::AddDelayData(CJS_DelayData* pData)
 {
         m_DelayData.Add(pData);
 }
 
 void Document::DoFieldDelay(const CFX_WideString& sFieldName, int nControlIndex)
 {
         CFX_DWordArray DelArray;
+        CFX_ArrayTemplate<CJS_DelayData*> DelayDataForFieldAndControlIndex;
 
         for (int i=0,sz=m_DelayData.GetSize(); i<sz; i++)
         {
                 if (CJS_DelayData* pData = m_DelayData.GetAt(i))
                 {
                         if (pData->sFieldName == sFieldName && pData->nControlIndex == nControlIndex)
                         {
-                                Field::DoDelay(m_pDocument, pData);
-                                delete pData;
+                                DelayDataForFieldAndControlIndex.Add(pData);
                                 m_DelayData.SetAt(i, NULL);
                                 DelArray.Add(i);
                         }
                 }
         }
 
         for (int j=DelArray.GetSize()-1; j>=0; j--)
         {
                 m_DelayData.RemoveAt(DelArray[j]);
         }
+
+        for (int i=0,sz=DelayDataForFieldAndControlIndex.GetSize(); i < sz; i++)
+        {
+                CJS_DelayData* pData = DelayDataForFieldAndControlIndex.GetAt(i);
+                Field::DoDelay(m_pDocument, pData);
+                DelayDataForFieldAndControlIndex.SetAt(i,NULL);
+                delete pData;
+        }
 }
 
 void Document::AddDelayAnnotData(CJS_AnnotObj *pData)
 {
         m_DelayAnnotData.Add(pData);
 }
 
 void Document::DoAnnotDelay()
 {
         CFX_DWordArray DelArray;
 
         for (int j=DelArray.GetSize()-1; j>=0; j--)
         {
                 m_DelayData.RemoveAt(DelArray[j]);
         }
 }
 
 CJS_Document* Document::GetCJSDoc() const 
 {
         return static_cast<CJS_Document*>(m_pJSObject);
 }