Fix heap-use-after-free in FT_Stream_ReleaseFrame

Fix heap-use-after-free in FT_Stream_ReleaseFrame

BUG=452793, 561478
R=tsepez@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/03ae07fabe4764ebb445d208fa199e285168ed25

[jun_fang, 2015-12-09 12:57:11]

Description was changed from

==========
Fix heap-use-after-free in FT_Stream_ReleaseFrame

BUG=561478
==========

to

==========
Fix heap-use-after-free in FT_Stream_ReleaseFrame

BUG=452793,561478
==========

[jun_fang, 2015-12-09 13:30:50]

jun_fang@foxitsoftware.com changed reviewers:
+ thestig@chromium.org, tsepez@chromium.org

[jun_fang, 2015-12-09 13:30:51]

Hi Tom and Lei,

Please help to review it. Thanks!

[Tom Sepez, 2015-12-09 19:11:54]

LGTM after adding comment

https://codereview.chromium.org/1512873002/diff/40001/core/src/fxge/ge/text_i...
File core/src/fxge/ge/text_int.h (right):

https://codereview.chromium.org/1512873002/diff/40001/core/src/fxge/ge/text_i...
core/src/fxge/ge/text_int.h:32: int ReleaseFace(FXFT_Face face);
Nit: please put a comment here describing return values, which I gather are 3
possibilities:

 ret < 0, releaseface not appropriate for this object.
 ret == 0, object released
 ret > 0, object still alive, other referrers.

[jun_fang, 2015-12-09 23:58:09]

https://codereview.chromium.org/1512873002/diff/40001/core/src/fxge/ge/text_i...
File core/src/fxge/ge/text_int.h (right):

https://codereview.chromium.org/1512873002/diff/40001/core/src/fxge/ge/text_i...
core/src/fxge/ge/text_int.h:32: int ReleaseFace(FXFT_Face face);
On 2015/12/09 19:11:54, Tom Sepez wrote:
> Nit: please put a comment here describing return values, which I gather are 3
> possibilities:
> 
>  ret < 0, releaseface not appropriate for this object.
>  ret == 0, object released
>  ret > 0, object still alive, other referrers.

Acknowledged.

[jun_fang, 2015-12-10 03:13:01]

Description was changed from

==========
Fix heap-use-after-free in FT_Stream_ReleaseFrame

BUG=452793,561478
==========

to

==========
Fix heap-use-after-free in FT_Stream_ReleaseFrame

BUG=452793,561478
R=tsepez@chromium.org

Committed:
https://pdfium.googlesource.com/pdfium/+/03ae07fabe4764ebb445d208fa199e285168...
==========

[jun_fang, 2015-12-10 03:13:06]

Committed patchset #4 (id:60001) manually as
03ae07fabe4764ebb445d208fa199e285168ed25 (presubmit successful).