Fix heap-use-after-free in FT_Stream_ReleaseFrame

core/src/fxge/ge/fx_ge_fontmap.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits>
 
 #include "core/include/fxge/fx_freetype.h"
 #include "core/include/fxge/fx_ge.h"
@@ skipping 419 matching lines @@
       FXFT_Done_Face(m_SingleFace.m_pFace);
     }
   } else if (m_Type == 2) {
     for (int i = 0; i < 16; i++)
       if (m_TTCFace.m_pFaces[i]) {
         FXFT_Done_Face(m_TTCFace.m_pFaces[i]);
       }
   }
   FX_Free(m_pFontData);
 }
-FX_BOOL CTTFontDesc::ReleaseFace(FXFT_Face face) {
+int CTTFontDesc::ReleaseFace(FXFT_Face face) {
   if (m_Type == 1) {
     if (m_SingleFace.m_pFace != face) {
-      return FALSE;
+      return -1;
     }
   } else if (m_Type == 2) {
     int i;
     for (i = 0; i < 16; i++)
       if (m_TTCFace.m_pFaces[i] == face) {
         break;
       }
     if (i == 16) {
-      return FALSE;
+      return -1;
     }
   }
   m_RefCount--;
   if (m_RefCount) {
-    return FALSE;
+    return m_RefCount;
   }
   delete this;
-  return TRUE;
+  return 0;
 }
 
 CFX_FontMgr::CFX_FontMgr() : m_FTLibrary(nullptr) {
   m_pBuiltinMapper.reset(new CFX_FontMapper(this));
 }
 
 CFX_FontMgr::~CFX_FontMgr() {
   for (const auto& pair : m_FaceMap)
     delete pair.second;
 
@@ skipping 143 matching lines @@
   FXFT_Face face = nullptr;
   if (FXFT_New_Face(library, filename, face_index, &face))
     return nullptr;
   return FXFT_Set_Pixel_Sizes(face, 64, 64) ? nullptr : face;
 }
 
 void CFX_FontMgr::ReleaseFace(FXFT_Face face) {
   if (!face) {
     return;
   }
+  FX_BOOL bNeedFaceDone = TRUE;
   auto it = m_FaceMap.begin();
   while (it != m_FaceMap.end()) {
     auto temp = it++;
-    if (temp->second->ReleaseFace(face)) {
+    int nRet = temp->second->ReleaseFace(face);
+    if (nRet == -1)
+      continue;
+    bNeedFaceDone = FALSE;
+    if (nRet == 0)
       m_FaceMap.erase(temp);
-    }
+    break;
   }
+  if (bNeedFaceDone && !m_pBuiltinMapper->IsBuiltinFace(face))
+    FXFT_Done_Face(face);
 }
 
 bool CFX_FontMgr::GetBuiltinFont(size_t index,
                                  const uint8_t** pFontData,
                                  FX_DWORD* size) {
   if (index < FX_ArraySize(g_FoxitFonts)) {
     *pFontData = g_FoxitFonts[index].m_pFontData;
     *size = g_FoxitFonts[index].m_dwSize;
     return true;
   }
@@ skipping 949 matching lines @@
 int PDF_GetStandardFontName(CFX_ByteString* name) {
   AltFontName* found = static_cast<AltFontName*>(
       FXSYS_bsearch(name->c_str(), g_AltFontNames, FX_ArraySize(g_AltFontNames),
                     sizeof(AltFontName), CompareString));
   if (!found)
     return -1;
 
   *name = g_Base14FontNames[found->m_Index];
   return found->m_Index;
 }