Fix a leak in CPDF_SyntaxParser::GetObject().

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Index: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index dd416fbd57a256f5441153b46ea6c52efc9c4c52..9bb822a126ef8a365bc13a2063933f3a69247f9e 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -2172,6 +2172,13 @@ CPDF_Object* CPDF_SyntaxParser::GetObject(CPDF_IndirectObjects* pObjList,
 
       ++nKeys;
       key = PDF_NameDecode(key);
+      if (key.IsEmpty())
+        continue;
+
+      CFX_ByteStringC keyNoSlash(key.c_str() + 1, key.GetLength() - 1);
+      if (keyNoSlash.IsEmpty())

[Lei Zhang, 2015/10/24 00:43:59]

It turns out CFX_CMapByteStringToPtr has a bug where its iterator can't find
items with a key of length 0. @_@.

+        continue;
+
       if (key == FX_BSTRC("/Contents"))
         dwSignValuePos = m_Pos;
 
@@ -2179,14 +2186,10 @@ CPDF_Object* CPDF_SyntaxParser::GetObject(CPDF_IndirectObjects* pObjList,
       if (!pObj)
         continue;
 
-      if (key.GetLength() >= 1) {
-        if (nKeys < 32) {
-          pDict->SetAt(CFX_ByteStringC(key.c_str() + 1, key.GetLength() - 1),
-                       pObj);
-        } else {
-          pDict->AddValue(CFX_ByteStringC(key.c_str() + 1, key.GetLength() - 1),
-                          pObj);
-        }
+      if (nKeys < 32) {
+        pDict->SetAt(keyNoSlash, pObj);

[Tom Sepez, 2015/10/24 17:04:46]

nit: One of my favorite lines of code.  Because checking for duplicates in
dictionaries is O(n), don't do it for big dictionaries.  Can you put a fixme
here about removing this once we have a smarter underlying representation for
dictionaries?

[Lei Zhang, 2015/10/26 20:54:23]

Ah, this smelled fishy. Wasn't sure exactly why.

+      } else {
+        pDict->AddValue(keyNoSlash, pObj);
       }
     }