Merge to M45: Fix heap use after free in CPDFSDK_Annot::GetPDFAnnot.

testing/embedder_test.cpp

 // Copyright (c) 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "embedder_test.h"
 
 #include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ skipping 202 matching lines @@
   IPDF_JSPLATFORM* platform = static_cast<IPDF_JSPLATFORM*>(this);
   memset(platform, 0, sizeof(IPDF_JSPLATFORM));
   platform->version = 1;
   platform->app_alert = AlertTrampoline;
 
   FPDF_FORMFILLINFO* formfillinfo = static_cast<FPDF_FORMFILLINFO*>(this);
   memset(formfillinfo, 0, sizeof(FPDF_FORMFILLINFO));
   formfillinfo->version = 1;
   formfillinfo->FFI_SetTimer = SetTimerTrampoline;
   formfillinfo->FFI_KillTimer = KillTimerTrampoline;
+  formfillinfo->FFI_GetPage = GetPageTrampoline;
   formfillinfo->m_pJsPlatform = platform;
 
   form_handle_ = FPDFDOC_InitFormFillEnvironment(document_, formfillinfo);
   FPDF_SetFormFieldHighlightColor(form_handle_, 0, 0xFFE4DD);
   FPDF_SetFormFieldHighlightAlpha(form_handle_, 100);
 
   return true;
 }
 
 void EmbedderTest::DoOpenActions() {
@@ skipping 18 matching lines @@
 FPDF_PAGE EmbedderTest::LoadPage(int page_number) {
   FPDF_PAGE page = FPDF_LoadPage(document_, page_number);
   if (!page) {
     return nullptr;
   }
   FORM_OnAfterLoadPage(page, form_handle_);
   FORM_DoPageAAction(page, form_handle_, FPDFPAGE_AACTION_OPEN);
   return page;
 }
 
+FPDF_PAGE EmbedderTest::LoadAndCachePage(int page_number) {
+  FPDF_PAGE page = delegate_->GetPage(form_handle_, document_, page_number);
+  if (!page) {
+    return nullptr;
+  }
+  FORM_DoPageAAction(page, form_handle_, FPDFPAGE_AACTION_OPEN);
+  return page;
+}
+
 FPDF_BITMAP EmbedderTest::RenderPage(FPDF_PAGE page) {
   int width = static_cast<int>(FPDF_GetPageWidth(page));
   int height = static_cast<int>(FPDF_GetPageHeight(page));
   FPDF_BITMAP bitmap = FPDFBitmap_Create(width, height, 0);
   FPDFBitmap_FillRect(bitmap, 0, 0, width, height, 0xFFFFFFFF);
   FPDF_RenderPageBitmap(bitmap, page, 0, 0, width, height, 0, 0);
   FPDF_FFLDraw(form_handle_, bitmap, page, 0, 0, width, height, 0, 0);
   return bitmap;
 }
 
 void EmbedderTest::UnloadPage(FPDF_PAGE page) {
   FORM_DoPageAAction(page, form_handle_, FPDFPAGE_AACTION_CLOSE);
   FORM_OnBeforeClosePage(page, form_handle_);
   FPDF_ClosePage(page);
 }
 
+FPDF_PAGE EmbedderTest::Delegate::GetPage(FPDF_FORMHANDLE form_handle,
+                                          FPDF_DOCUMENT document,
+                                          int page_index) {
+  auto it = m_pageMap.find(page_index);
+  if (it != m_pageMap.end()) {
+    return it->second;
+  }
+  FPDF_PAGE page = FPDF_LoadPage(document, page_index);
+  if (!page) {
+    return nullptr;
+  }
+  m_pageMap[page_index] = page;
+  FORM_OnAfterLoadPage(page, form_handle);
+  return page;
+}
+
 // static
 void EmbedderTest::UnsupportedHandlerTrampoline(UNSUPPORT_INFO* info,
                                                 int type) {
   EmbedderTest* test = static_cast<EmbedderTest*>(info);
   test->delegate_->UnsupportedHandler(type);
 }
 
 // static
 int EmbedderTest::AlertTrampoline(IPDF_JSPLATFORM* platform,
                                   FPDF_WIDESTRING message,
@@ skipping 10 matching lines @@
   EmbedderTest* test = static_cast<EmbedderTest*>(info);
   return test->delegate_->SetTimer(msecs, fn);
 }
 
 // static
 void EmbedderTest::KillTimerTrampoline(FPDF_FORMFILLINFO* info, int id) {
   EmbedderTest* test = static_cast<EmbedderTest*>(info);
   return test->delegate_->KillTimer(id);
 }
 
+// static
+FPDF_PAGE EmbedderTest::GetPageTrampoline(FPDF_FORMFILLINFO* info,
+                                          FPDF_DOCUMENT document,
+                                          int page_index) {
+  EmbedderTest* test = static_cast<EmbedderTest*>(info);
+  return test->delegate_->GetPage(test->m_pFormfillinfo, document, page_index);
+}
+
 // Can't use gtest-provided main since we need to stash the path to the
 // executable in order to find the external V8 binary data files.
 int main(int argc, char** argv) {
   g_exe_path_ = argv[0];
   testing::InitGoogleTest(&argc, argv);
   testing::InitGoogleMock(&argc, argv);
   return RUN_ALL_TESTS();
 }