fix issue of Heap Use-After-Free in CXFA_LayoutItem::AddChild

xfa/fxfa/parser/xfa_layout_itemlayout.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fxfa/parser/xfa_layout_itemlayout.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 528 matching lines @@
     if (pExistingChildItem) {
       pExistingChildItem->m_pNextSibling = pChildItem->m_pNextSibling;
     }
   }
   pChildItem->m_pNextSibling = NULL;
   pChildItem->m_pParent = NULL;
 }
 CXFA_ContentLayoutItem* CXFA_ItemLayoutProcessor::ExtractLayoutItem() {
   CXFA_ContentLayoutItem* pLayoutItem = m_pLayoutItem;
   if (pLayoutItem) {
-    m_pLayoutItem = (CXFA_ContentLayoutItem*)pLayoutItem->m_pNextSibling;
-    pLayoutItem->m_pNextSibling = NULL;
+    m_pLayoutItem =
+        static_cast<CXFA_ContentLayoutItem*>(pLayoutItem->m_pNextSibling);
+    pLayoutItem->m_pNextSibling = nullptr;
   }
-  if (m_nCurChildNodeStage == XFA_ItemLayoutProcessorStages_Done &&
-      ToContentLayoutItem(m_pOldLayoutItem)) {
-    if (m_pOldLayoutItem->m_pPrev) {
-      m_pOldLayoutItem->m_pPrev->m_pNext = NULL;
-    }
-    CXFA_FFNotify* pNotify =
-        m_pOldLayoutItem->m_pFormNode->GetDocument()->GetParser()->GetNotify();
-    CXFA_LayoutProcessor* pDocLayout =
-        m_pOldLayoutItem->m_pFormNode->GetDocument()->GetDocLayout();
-    CXFA_ContentLayoutItem* pOldLayoutItem = m_pOldLayoutItem;
-    while (pOldLayoutItem) {
-      CXFA_ContentLayoutItem* pNextOldLayoutItem = pOldLayoutItem->m_pNext;
-      pNotify->OnLayoutItemRemoving(pDocLayout, pOldLayoutItem);
-      delete pOldLayoutItem;
-      pOldLayoutItem = pNextOldLayoutItem;
-    }
-    m_pOldLayoutItem = NULL;
+  if (m_nCurChildNodeStage != XFA_ItemLayoutProcessorStages_Done ||
+      !ToContentLayoutItem(m_pOldLayoutItem))
+    return pLayoutItem;
+  if (m_pOldLayoutItem->m_pPrev)
+    m_pOldLayoutItem->m_pPrev->m_pNext = nullptr;
+  CXFA_FFNotify* pNotify =
+      m_pOldLayoutItem->m_pFormNode->GetDocument()->GetParser()->GetNotify();
+  CXFA_LayoutProcessor* pDocLayout =
+      m_pOldLayoutItem->m_pFormNode->GetDocument()->GetDocLayout();
+  CXFA_ContentLayoutItem* pOldLayoutItem = m_pOldLayoutItem;
+  while (pOldLayoutItem) {
+    CXFA_ContentLayoutItem* pNextOldLayoutItem = pOldLayoutItem->m_pNext;
+    pNotify->OnLayoutItemRemoving(pDocLayout, pOldLayoutItem);
+    if (pOldLayoutItem->m_pParent)
+      pOldLayoutItem->m_pParent->RemoveChild(pOldLayoutItem);
+    delete pOldLayoutItem;
+    pOldLayoutItem = pNextOldLayoutItem;
   }
+  m_pOldLayoutItem = nullptr;
   return pLayoutItem;
 }
 static FX_BOOL XFA_ItemLayoutProcessor_FindBreakNode(
     CXFA_Node* pContainerNode,
     CXFA_Node*& pCurActionNode,
     XFA_ItemLayoutProcessorStages& nCurStage,
     FX_BOOL bBreakBefore) {
   FX_BOOL bFindRs = FALSE;
   for (CXFA_Node* pBreakNode = pContainerNode; pBreakNode;
        pBreakNode = pBreakNode->GetNodeItem(XFA_NODEITEM_NextSibling)) {
@@ skipping 2382 matching lines @@
         (int32_t)(uintptr_t)m_PendingNodesCount.GetValueAt(pTemplate);
     if (iCount >= iMax) {
       return FALSE;
     }
     iCount++;
     m_PendingNodesCount.SetAt(pTemplate, (void*)(uintptr_t)(iCount));
     return TRUE;
   }
   return TRUE;
 }