Fix a potential UAF with FPDFAvail_IsLinearized().

core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp

Index: core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp
diff --git a/core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp b/core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp
index f210c49c71b9ac947cf9f668bd6c958075b4c979..5bf7d631d4a7f4bbc68fd13437d446b5d07f78ff 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp
@@ -851,8 +851,8 @@ FX_BOOL CPDF_DataAvail::IsLinearizedFile(uint8_t* pData, uint32_t dwLen) {
 
   uint32_t objnum = FXSYS_atoui(wordObjNum.c_str());
   if (m_pLinearized) {
+    m_pHintTables.reset();

[Wei Li, 2016/05/11 00:26:25]

Will we lose hint stream info then? Will we still need that info for subsequent
loading?

[Lei Zhang, 2016/05/11 01:16:21]

Yes, and that's not optimal. See patch set 2 - use the cached result instead.
There's no point in reparsing the header again, right?

     m_pLinearized->Release();
-    m_pLinearized = nullptr;
   }
 
   m_pLinearized =
@@ -861,22 +861,22 @@ FX_BOOL CPDF_DataAvail::IsLinearizedFile(uint8_t* pData, uint32_t dwLen) {
     return FALSE;
 
   CPDF_Dictionary* pDict = m_pLinearized->GetDict();
-  if (pDict && pDict->GetObjectBy("Linearized")) {
-    CPDF_Object* pLen = pDict->GetObjectBy("L");
-    if (!pLen)
-      return FALSE;
+  if (!pDict || !pDict->GetObjectBy("Linearized"))
+    return FALSE;
 
-    if ((FX_FILESIZE)pLen->GetInteger() != m_pFileRead->GetSize())
-      return FALSE;
+  CPDF_Object* pLen = pDict->GetObjectBy("L");
+  if (!pLen)
+    return FALSE;
+
+  if ((FX_FILESIZE)pLen->GetInteger() != m_pFileRead->GetSize())
+    return FALSE;
 
-    m_bLinearized = TRUE;
+  m_bLinearized = TRUE;
 
-    if (CPDF_Number* pNo = ToNumber(pDict->GetObjectBy("P")))
-      m_dwFirstPageNo = pNo->GetInteger();
+  if (CPDF_Number* pNo = ToNumber(pDict->GetObjectBy("P")))
+    m_dwFirstPageNo = pNo->GetInteger();
 
-    return TRUE;
-  }
-  return FALSE;
+  return TRUE;
 }
 
 FX_BOOL CPDF_DataAvail::CheckEnd(IPDF_DataAvail::DownloadHints* pHints) {