Fix a leak in CPDF_SyntaxParser::GetObject().

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <set>
 #include <utility>
 #include <vector>
 
@@ skipping 2154 matching lines @@
 
       if (key == FX_BSTRC("endobj")) {
         m_Pos = SavedPos;
         break;
       }
       if (key[0] != '/')
         continue;
 
       ++nKeys;
       key = PDF_NameDecode(key);
+      if (key.IsEmpty())
+        continue;
+
+      CFX_ByteStringC keyNoSlash(key.c_str() + 1, key.GetLength() - 1);
+      if (keyNoSlash.IsEmpty())

[Lei Zhang, 2015/10/24 00:43:59]

It turns out CFX_CMapByteStringToPtr has a bug where its iterator can't find
items with a key of length 0. @_@.

+        continue;
+
       if (key == FX_BSTRC("/Contents"))
         dwSignValuePos = m_Pos;
 
       CPDF_Object* pObj = GetObject(pObjList, objnum, gennum);
       if (!pObj)
         continue;
 
-      if (key.GetLength() >= 1) {
-        if (nKeys < 32) {
-          pDict->SetAt(CFX_ByteStringC(key.c_str() + 1, key.GetLength() - 1),
-                       pObj);
-        } else {
-          pDict->AddValue(CFX_ByteStringC(key.c_str() + 1, key.GetLength() - 1),
-                          pObj);
-        }
+      if (nKeys < 32) {
+        pDict->SetAt(keyNoSlash, pObj);

[Tom Sepez, 2015/10/24 17:04:46]

nit: One of my favorite lines of code.  Because checking for duplicates in
dictionaries is O(n), don't do it for big dictionaries.  Can you put a fixme
here about removing this once we have a smarter underlying representation for
dictionaries?

[Lei Zhang, 2015/10/26 20:54:23]

Ah, this smelled fishy. Wasn't sure exactly why.

+      } else {
+        pDict->AddValue(keyNoSlash, pObj);
       }
     }
 
     if (IsSignatureDict(pDict.get())) {
       FX_FILESIZE dwSavePos = m_Pos;
       m_Pos = dwSignValuePos;
       CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, NULL, FALSE);
       pDict->SetAt(FX_BSTRC("Contents"), pObj);
       m_Pos = dwSavePos;
     }
@@ skipping 2408 matching lines @@
   return FALSE;
 }
 CPDF_PageNode::~CPDF_PageNode() {
   int32_t iSize = m_childNode.GetSize();
   for (int32_t i = 0; i < iSize; ++i) {
     CPDF_PageNode* pNode = (CPDF_PageNode*)m_childNode[i];
     delete pNode;
   }
   m_childNode.RemoveAll();
 }