Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(516)

Unified Diff: xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp

Issue 1680463002: Fix heap-use-after-free in CXFA_FFWidget::GetDataAcc() (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
diff --git a/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp b/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
index 8e0a9444c5dcef2f37fe8a7edb53d6466267a05a..855483bbae68f226d42fd9002c5a62b5f977c2fd 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
@@ -52,6 +52,7 @@ void XFA_ReleaseLayoutItem(CXFA_LayoutItem* pLayoutItem) {
XFA_ReleaseLayoutItem(pNode);
pNode = pNext;
}
+ pNotify->OnLayoutEvent(pDocLayout, pLayoutItem, XFA_LAYOUTEVENT_ItemRemoving);
jun_fang 2016/02/06 03:49:27 The information about destroy of pLayoutItem shoul
if (pLayoutItem->m_pFormNode->GetClassID() == XFA_ELEMENT_PageArea) {
pNotify->OnPageEvent(static_cast<CXFA_ContainerLayoutItem*>(pLayoutItem),
XFA_PAGEEVENT_PageRemoved);
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698