Do not use invalidated std::map::iterators in PDF_ReplaceAbbr().

core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/src/fpdfapi/fpdf_page/pageint.h"
 
 #include "core/include/fpdfapi/fpdf_module.h"
 #include "core/include/fpdfapi/fpdf_page.h"
@@ skipping 32 matching lines @@
     {_FX_BSTRC("Indexed"), _FX_BSTRC("I")},
     {_FX_BSTRC("ASCIIHexDecode"), _FX_BSTRC("AHx")},
     {_FX_BSTRC("ASCII85Decode"), _FX_BSTRC("A85")},
     {_FX_BSTRC("LZWDecode"), _FX_BSTRC("LZW")},
     {_FX_BSTRC("FlateDecode"), _FX_BSTRC("Fl")},
     {_FX_BSTRC("RunLengthDecode"), _FX_BSTRC("RL")},
     {_FX_BSTRC("CCITTFaxDecode"), _FX_BSTRC("CCF")},
     {_FX_BSTRC("DCTDecode"), _FX_BSTRC("DCT")},
 };
 
+struct AbbrReplacementOp {
+  bool is_replace_key;
+  CFX_ByteString key;
+  CFX_ByteStringC replacement;
+};
+
 CFX_ByteStringC PDF_FindFullName(const PDF_AbbrPairs* table,
                                  size_t count,
                                  const CFX_ByteStringC& abbr) {
   for (size_t i = 0; i < count; ++i) {
     if (abbr.GetLength() != table[i].abbr.m_Size)
       continue;
     if (memcmp(abbr.GetPtr(), table[i].abbr.m_Ptr, abbr.GetLength()))
       continue;
     return CFX_ByteStringC(table[i].full_name.m_Ptr, table[i].full_name.m_Size);
   }
   return CFX_ByteStringC();
 }
 
-CFX_ByteStringC PDF_FindAbbrName(const PDF_AbbrPairs* table,
-                                 size_t count,
-                                 const CFX_ByteStringC& name) {
-  for (size_t i = 0; i < count; ++i) {
-    if (name.GetLength() != table[i].full_name.m_Size)
-      continue;
-    if (memcmp(name.GetPtr(), table[i].full_name.m_Ptr, name.GetLength()))
-      continue;
-    return CFX_ByteStringC(table[i].abbr.m_Ptr, table[i].abbr.m_Size);
-  }
-  return CFX_ByteStringC();
-}
-
 }  // namespace
 
 CPDF_StreamContentParser::CPDF_StreamContentParser(
     CPDF_Document* pDocument,
     CPDF_Dictionary* pPageResources,
     CPDF_Dictionary* pParentResources,
     CFX_Matrix* pmtContentToUser,
     CPDF_PageObjects* pObjList,
     CPDF_Dictionary* pResources,
     CPDF_Rect* pBBox,
@@ skipping 400 matching lines @@
     return;
   }
   CFX_ByteString tag = GetString(0);
   m_CurContentMark.GetModify()->AddMark(tag, NULL, FALSE);
 }
 
 void PDF_ReplaceAbbr(CPDF_Object* pObj) {
   switch (pObj->GetType()) {
     case PDFOBJ_DICTIONARY: {
       CPDF_Dictionary* pDict = pObj->AsDictionary();
+      std::vector<AbbrReplacementOp> replacements;
       for (const auto& it : *pDict) {
         CFX_ByteString key = it.first;
         CPDF_Object* value = it.second;
         CFX_ByteStringC fullname = PDF_FindFullName(
             PDF_InlineKeyAbbr, FX_ArraySize(PDF_InlineKeyAbbr), key);
         if (!fullname.IsEmpty()) {
-          pDict->ReplaceKey(key, fullname);
+          AbbrReplacementOp op;
+          op.is_replace_key = true;
+          op.key = key;
+          op.replacement = fullname;
+          replacements.push_back(op);
           key = fullname;
         }
 
         if (value->IsName()) {
           CFX_ByteString name = value->GetString();
           fullname = PDF_FindFullName(PDF_InlineValueAbbr,
                                       FX_ArraySize(PDF_InlineValueAbbr), name);
           if (!fullname.IsEmpty()) {
-            pDict->SetAtName(key, fullname);
+            AbbrReplacementOp op;
+            op.is_replace_key = false;
+            op.key = key;
+            op.replacement = fullname;
+            replacements.push_back(op);
           }
         } else {
           PDF_ReplaceAbbr(value);
         }
       }
+      for (const auto& op : replacements) {
+        if (op.is_replace_key)
+          pDict->ReplaceKey(op.key, op.replacement);
+        else
+          pDict->SetAtName(op.key, op.replacement);
+      }
       break;
     }
     case PDFOBJ_ARRAY: {
       CPDF_Array* pArray = pObj->AsArray();
       for (FX_DWORD i = 0; i < pArray->GetCount(); i++) {
         CPDF_Object* pElement = pArray->GetElement(i);
         if (pElement->IsName()) {
           CFX_ByteString name = pElement->GetString();
           CFX_ByteStringC fullname = PDF_FindFullName(
               PDF_InlineValueAbbr, FX_ArraySize(PDF_InlineValueAbbr), name);
           if (!fullname.IsEmpty()) {
             pArray->SetAt(i, new CPDF_Name(fullname));
           }
         } else {
           PDF_ReplaceAbbr(pElement);
         }
       }
       break;
     }
   }
 }
 
-void PDF_ReplaceFull(CPDF_Object* pObj) {
-  switch (pObj->GetType()) {
-    case PDFOBJ_DICTIONARY: {
-      CPDF_Dictionary* pDict = pObj->AsDictionary();
-      for (const auto& it : *pDict) {
-        CFX_ByteString key = it.first;
-        CPDF_Object* value = it.second;
-        CFX_ByteStringC abbrName = PDF_FindAbbrName(
-            PDF_InlineKeyAbbr, FX_ArraySize(PDF_InlineKeyAbbr), key);
-        if (!abbrName.IsEmpty()) {
-          pDict->ReplaceKey(key, abbrName);
-          key = abbrName;
-        }
-        if (value->IsName()) {
-          CFX_ByteString name = value->GetString();
-          abbrName = PDF_FindAbbrName(PDF_InlineValueAbbr,
-                                      FX_ArraySize(PDF_InlineValueAbbr), name);
-          if (!abbrName.IsEmpty()) {
-            pDict->SetAtName(key, abbrName);
-          }
-        } else {
-          PDF_ReplaceFull(value);
-        }
-      }
-      break;
-    }
-    case PDFOBJ_ARRAY: {
-      CPDF_Array* pArray = pObj->AsArray();
-      for (FX_DWORD i = 0; i < pArray->GetCount(); i++) {
-        CPDF_Object* pElement = pArray->GetElement(i);
-        if (pElement->IsName()) {
-          CFX_ByteString name = pElement->GetString();
-          CFX_ByteStringC abbrName = PDF_FindAbbrName(
-              PDF_InlineValueAbbr, FX_ArraySize(PDF_InlineValueAbbr), name);
-          if (!abbrName.IsEmpty()) {
-            pArray->SetAt(i, new CPDF_Name(abbrName));
-          }
-        } else {
-          PDF_ReplaceFull(pElement);
-        }
-      }
-      break;
-    }
-  }
-}
 void CPDF_StreamContentParser::Handle_BeginText() {
   m_pCurStates->m_TextMatrix.Set(1.0f, 0, 0, 1.0f, 0, 0);
   OnChangeTextMatrix();
   m_pCurStates->m_TextX = 0;
   m_pCurStates->m_TextY = 0;
   m_pCurStates->m_TextLineX = 0;
   m_pCurStates->m_TextLineY = 0;
 }
 void CPDF_StreamContentParser::Handle_BeginSectionUndefined() {
   m_CompatCount++;
@@ skipping 919 matching lines @@
     m_pObjectList->m_ObjectList.AddTail(pPathObj);
   }
   if (PathClipType) {
     if (!matrix.IsIdentity()) {
       Path.Transform(&matrix);
       matrix.SetIdentity();
     }
     m_pCurStates->m_ClipPath.AppendPath(Path, PathClipType, TRUE);
   }
 }