Merge to M45: Fix heap use after free in CPDFSDK_Annot::GetPDFAnnot.

fpdfsdk/src/fsdk_mgr.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../public/fpdf_ext.h"
 #include "../../third_party/base/nonstd_unique_ptr.h"
 #include "../include/fsdk_define.h"
 #include "../include/fsdk_mgr.h"
@@ skipping 595 matching lines @@
         m_bExitWidget = FALSE;
         m_bOnWidget = FALSE;
         m_CaptureWidget = NULL;
         m_bValid = FALSE;
         m_bLocked = FALSE;
         m_bTakeOverPage = FALSE;
 }
 
 CPDFSDK_PageView::~CPDFSDK_PageView()
 {
-        CPDFDoc_Environment* pEnv = m_pSDKDoc->GetEnv();
-        int nAnnotCount = m_fxAnnotArray.GetSize();
+    // if there is a focused annot on the page, we should kill the focus first.
+    if (CPDFSDK_Annot* focusedAnnot = m_pSDKDoc->GetFocusAnnot()) {
+      for (int i = 0, count = m_fxAnnotArray.GetSize(); i < count; i++) {
+        CPDFSDK_Annot* pAnnot = (CPDFSDK_Annot*)m_fxAnnotArray.GetAt(i);
+        if (pAnnot == focusedAnnot) {
+          KillFocusAnnot();
+          break;
+        }
+      }
+    }
 
-        for (int i=0; i<nAnnotCount; i++)
-        {
-                CPDFSDK_Annot* pAnnot = (CPDFSDK_Annot*)m_fxAnnotArray.GetAt(i);
-                //if there is a focused annot on the page, we should kill the focus first.
-                if(pAnnot == m_pSDKDoc->GetFocusAnnot())
-                        KillFocusAnnot();
-                CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-                ASSERT(pAnnotHandlerMgr);
-                pAnnotHandlerMgr->ReleaseAnnot(pAnnot);
-        }
-        m_fxAnnotArray.RemoveAll();
+    CPDFDoc_Environment* pEnv = m_pSDKDoc->GetEnv();
+    CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
+    ASSERT(pAnnotHandlerMgr);
+    for (int i = 0, count = m_fxAnnotArray.GetSize(); i < count; i++) {
+      CPDFSDK_Annot* pAnnot = (CPDFSDK_Annot*)m_fxAnnotArray.GetAt(i);
+      pAnnotHandlerMgr->ReleaseAnnot(pAnnot);
+    }
+    m_fxAnnotArray.RemoveAll();
 
-        delete m_pAnnotList;
-        m_pAnnotList = NULL;
+    delete m_pAnnotList;
+    m_pAnnotList = NULL;
 
-        m_page->RemovePrivateData((void*)m_page);
-        if(m_bTakeOverPage) {
-            delete m_page;
-        }
+    m_page->RemovePrivateData((void*)m_page);
+    if (m_bTakeOverPage) {
+      delete m_page;
+    }
 }
 
 void CPDFSDK_PageView::PageView_OnDraw(CFX_RenderDevice* pDevice, CPDF_Matrix* pUser2Device,CPDF_RenderOptions* pOptions)
 {
     m_curMatrix = *pUser2Device;
 
     CPDFDoc_Environment* pEnv = m_pSDKDoc->GetEnv();
     CPDFSDK_AnnotIterator annotIterator(this, TRUE);
     CPDFSDK_Annot* pSDKAnnot = nullptr;
     int index = -1;
@@ skipping 394 matching lines @@
 
         for(int i=0; i<m_fxAnnotArray.GetSize(); i++)
         {
                 CPDFSDK_Annot* pAnnot = (CPDFSDK_Annot*)m_fxAnnotArray.GetAt(i);
                 if(pAnnot == pFocusAnnot)
                         return pAnnot;
         }
         return NULL;
 }