Disable JBIG2 cache; prevent data corruption - try 2.

core/src/fxcodec/jbig2/JBig2_Context.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JBig2_Context.h"
 
 #include <list>
 
 #include "JBig2_GrdProc.h"
 #include "JBig2_GrrdProc.h"
 #include "JBig2_HtrdProc.h"
 #include "JBig2_PddProc.h"
 #include "JBig2_SddProc.h"
 #include "JBig2_TrdProc.h"
 
 // Implement a very small least recently used (LRU) cache. It is very
 // common for a JBIG2 dictionary to span multiple pages in a PDF file,
 // and we do not want to decode the same dictionary over and over
 // again. We key off of the memory location of the dictionary. The
 // list keeps track of the freshness of entries, with freshest ones
 // at the front. Even a tiny cache size like 2 makes a dramatic
 // difference for typical JBIG2 documents.
 //
 // Disabled until we can figure out how to clear cache between documents.
 // https://code.google.com/p/pdfium/issues/detail?id=207
+#define DISABLE_SYMBOL_CACHE
+#ifndef DISABLE_SYMBOL_CACHE
 static const int kSymbolDictCacheMaxSize = 2;
+#endif
 
 CJBig2_Context* CJBig2_Context::CreateContext(
     const uint8_t* pGlobalData,
     FX_DWORD dwGlobalLength,
     const uint8_t* pData,
     FX_DWORD dwLength,
     std::list<CJBig2_CachePair>* pSymbolDictCache,
     IFX_Pause* pPause) {
   return new CJBig2_Context(pGlobalData, dwGlobalLength, pData, dwLength,
                             pSymbolDictCache, pPause);
@@ skipping 577 matching lines @@
     if (pSymbolDictDecoder->SDREFAGG == 1) {
       dwTemp = pSymbolDictDecoder->SDRTEMPLATE ? 1 << 10 : 1 << 13;
       grContext = FX_Alloc(JBig2ArithCtx, dwTemp);
       JBIG2_memset(grContext, 0, sizeof(JBig2ArithCtx) * dwTemp);
     }
   }
   pSegment->m_nResultType = JBIG2_SYMBOL_DICT_POINTER;
   for (std::list<CJBig2_CachePair>::iterator it = m_pSymbolDictCache->begin();
        it != m_pSymbolDictCache->end(); ++it) {
     if (it->first == key) {
-      pSegment->m_Result.sd = it->second->DeepCopy();
+      nonstd::unique_ptr<CJBig2_SymbolDict> copy(it->second->DeepCopy());
+      pSegment->m_Result.sd = copy.release();
       m_pSymbolDictCache->push_front(*it);
       m_pSymbolDictCache->erase(it);
       cache_hit = true;
       break;
     }
   }
   if (!cache_hit) {
     if (pSymbolDictDecoder->SDHUFF == 0) {
       pArithDecoder = new CJBig2_ArithDecoder(m_pStream.get());
       pSegment->m_Result.sd =
           pSymbolDictDecoder->decode_Arith(pArithDecoder, gbContext, grContext);
       delete pArithDecoder;
       if (pSegment->m_Result.sd == NULL) {
         nRet = JBIG2_ERROR_FATAL;
         goto failed;
       }
       m_pStream->alignByte();
       m_pStream->offset(2);
     } else {
       pSegment->m_Result.sd = pSymbolDictDecoder->decode_Huffman(
           m_pStream.get(), gbContext, grContext, pPause);
       if (pSegment->m_Result.sd == NULL) {
         nRet = JBIG2_ERROR_FATAL;
         goto failed;
       }
       m_pStream->alignByte();
     }
-    CJBig2_SymbolDict* value = pSegment->m_Result.sd->DeepCopy();
+#ifndef DISABLE_SYMBOL_CACHE
+    nonstd::unique_ptr<CJBig2_SymbolDict> value =
+        pSegment->m_Result.sd->DeepCopy();
     if (value && kSymbolDictCacheMaxSize > 0) {
       while (m_pSymbolDictCache->size() >= kSymbolDictCacheMaxSize) {
         delete m_pSymbolDictCache->back().second;
         m_pSymbolDictCache->pop_back();
       }
-      m_pSymbolDictCache->push_front(CJBig2_CachePair(key, value));
+      m_pSymbolDictCache->push_front(CJBig2_CachePair(key, value.release()));
     }
+#endif
   }
   if (wFlags & 0x0200) {
     pSegment->m_Result.sd->m_bContextRetained = TRUE;
     if (pSymbolDictDecoder->SDHUFF == 0) {
       pSegment->m_Result.sd->m_gbContext = gbContext;
     }
     if (pSymbolDictDecoder->SDREFAGG == 1) {
       pSegment->m_Result.sd->m_grContext = grContext;
     }
     bUsed = TRUE;
@@ skipping 900 matching lines @@
         SBSYMCODES[CURTEMP].code = CURCODE;
         CURCODE = CURCODE + 1;
       }
       CURTEMP = CURTEMP + 1;
     }
     CURLEN = CURLEN + 1;
   }
   FX_Free(LENCOUNT);
   FX_Free(FIRSTCODE);
 }