Fix heap-use-after-free in FT_Stream_ReleaseFrame

core/src/fxge/ge/text_int.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_SRC_FXGE_GE_TEXT_INT_H_
 #define CORE_SRC_FXGE_GE_TEXT_INT_H_
 
 #include "core/include/fxge/fx_font.h"
@@ skipping 11 matching lines @@
   CFX_MapPtrToPtr m_GlyphMap;
 };
 class CTTFontDesc {
  public:
   CTTFontDesc() {
     m_Type = 0;
     m_pFontData = NULL;
     m_RefCount = 0;
   }
   ~CTTFontDesc();
-  FX_BOOL ReleaseFace(FXFT_Face face);
+  int ReleaseFace(FXFT_Face face);

[Tom Sepez, 2015/12/09 19:11:54]

Nit: please put a comment here describing return values, which I gather are 3
possibilities:

 ret < 0, releaseface not appropriate for this object.
 ret == 0, object released
 ret > 0, object still alive, other referrers.

[jun_fang, 2015/12/09 23:58:09]

Acknowledged.

   int m_Type;
   union {
     struct {
       FX_BOOL m_bItalic;
       FX_BOOL m_bBold;
       FXFT_Face m_pFace;
     } m_SingleFace;
     struct {
       FXFT_Face m_pFaces[16];
     } m_TTCFace;
@@ skipping 27 matching lines @@
   const CFX_ByteString m_FilePath;
   const CFX_ByteString m_FaceName;
   const CFX_ByteString m_FontTables;
   const FX_DWORD m_FontOffset;
   const FX_DWORD m_FileSize;
   FX_DWORD m_Styles;
   FX_DWORD m_Charsets;
 };
 
 #endif  // CORE_SRC_FXGE_GE_TEXT_INT_H_