Fix crash from commit f6dafc9.

core/src/fpdfapi/fpdf_edit/fpdf_edit_create.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "editint.h"
 
 #include "core/include/fxcrt/fx_ext.h"
 #include "core/include/fpdfapi/fpdf_serial.h"
@@ skipping 1301 matching lines @@
       m_Offset += size;
       if (AppendObjectNumberToXRef(objnum) < 0) {
         return -1;
       }
     }
     FX_Free(pBuffer);
   }
   return 1;
 }
 int32_t CPDF_Creator::WriteOldObjs(IFX_Pause* pPause) {
   FX_DWORD nLastObjNum = m_pParser->GetLastObjNum();

[Wei Li, 2015/12/24 18:09:14]

Need to check here too?

[Lei Zhang, 2015/12/24 18:53:42]

It was already dereferencing |m_pParser| without a check before my CL, so I'm
leaving it as is.

   if (!m_pParser->IsValidObjectNumber(nLastObjNum))
     return 0;
 
   FX_DWORD objnum = (FX_DWORD)(uintptr_t)m_Pos;
   for (; objnum <= nLastObjNum; ++objnum) {
     int32_t iRet = WriteOldIndirectObject(objnum);
     if (iRet < 0)
       return iRet;
 
     if (!iRet)
@@ skipping 65 matching lines @@
     CPDF_Object* pObj;
     m_pDocument->m_IndirectObjs.GetNextAssoc(pos, (void*&)key, (void*&)pObj);
     FX_DWORD objnum = (FX_DWORD)key;
     if (pObj->GetObjNum() == -1) {
       continue;
     }
     if (bIncremental) {
       if (!pObj->IsModified()) {
         continue;
       }
-    } else if (m_pParser->IsValidObjectNumber(objnum) &&
+    } else if (m_pParser && m_pParser->IsValidObjectNumber(objnum) &&
                m_pParser->m_V5Type[objnum]) {
       continue;
     }
     AppendNewObjNum(objnum);
   }
   int32_t iCount = m_NewObjNumArray.GetSize();
   if (iCount == 0) {
     return;
   }
   int32_t i = 0;
   FX_DWORD dwStartObjNum = 0;
   FX_BOOL bCrossRefValid = m_pParser && m_pParser->GetLastXRefOffset() > 0;
   while (i < iCount) {
     dwStartObjNum = m_NewObjNumArray.ElementAt(i);
     if ((bIncremental && (bNoOriginal || bCrossRefValid)) ||
         !m_ObjectOffset.GetPtrAt(dwStartObjNum)) {
       break;
     }
     i++;
   }
   if (i >= iCount) {
     return;
   }
   FX_DWORD dwLastObjNum = dwStartObjNum;
   i++;
   FX_BOOL bNewStart = FALSE;
   for (; i < iCount; i++) {
     FX_DWORD dwCurObjNum = m_NewObjNumArray.ElementAt(i);
-    bool bExist = m_pParser->IsValidObjectNumber(dwCurObjNum) &&
+    bool bExist = m_pParser && m_pParser->IsValidObjectNumber(dwCurObjNum) &&
                   m_ObjectOffset.GetPtrAt(dwCurObjNum);
     if (bExist || dwCurObjNum - dwLastObjNum > 1) {
       if (!bNewStart) {
         m_ObjectOffset.Add(dwStartObjNum, dwLastObjNum - dwStartObjNum + 1);
         m_ObjectSize.Add(dwStartObjNum, dwLastObjNum - dwStartObjNum + 1);
       }
       dwStartObjNum = dwCurObjNum;
     }
     if (bNewStart) {
       dwStartObjNum = dwCurObjNum;
@@ skipping 656 matching lines @@
   m_bNewCrypto = FALSE;
   if (!m_bStandardSecurity) {
     return;
   }
   if (m_pEncryptDict) {
     m_pEncryptDict->Release();
     m_pEncryptDict = NULL;
   }
   m_bStandardSecurity = FALSE;
 }