Fix a potential nullptr deref in CFX_MapPtrToPtr.

core/fxcrt/fx_basic_list.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcrt/include/fx_basic.h"
 #include "core/fxcrt/plex.h"
 
 CFX_PtrList::CFX_PtrList(int nBlockSize)
@@ skipping 57 matching lines @@
 void CFX_PtrList::FreeNode(CFX_PtrList::CNode* pNode) {
   pNode->pNext = m_pNodeFree;
   m_pNodeFree = pNode;
   m_nCount--;
   if (m_nCount == 0) {
     RemoveAll();
   }
 }
 void CFX_PtrList::RemoveAll() {
   m_nCount = 0;
   m_pNodeHead = m_pNodeTail = m_pNodeFree = NULL;

[Tom Sepez, 2016/05/19 17:02:01]

nit: one per pline.

[Lei Zhang, 2016/05/19 20:48:50]

Done.

-  m_pBlocks->FreeDataChain();
+  if (m_pBlocks)

[Tom Sepez, 2016/05/19 17:02:01]

Ah, idempotency.

Nit: As long as we're going to test it, we can conditionalize the NULL
assignment by this if statement.

[Lei Zhang, 2016/05/19 20:48:50]

Done.

+    m_pBlocks->FreeDataChain();
   m_pBlocks = NULL;

[Tom Sepez, 2016/05/19 17:02:01]

nit: nullptr, also above.

[Lei Zhang, 2016/05/19 20:48:50]

Done.

 }
 CFX_PtrList::CNode* CFX_PtrList::NewNode(CFX_PtrList::CNode* pPrev,
                                          CFX_PtrList::CNode* pNext) {
   if (!m_pNodeFree) {
     CFX_Plex* pNewBlock =
         CFX_Plex::Create(m_pBlocks, m_nBlockSize, sizeof(CNode));
     CNode* pNode = (CNode*)pNewBlock->data();
     pNode += m_nBlockSize - 1;
     for (int i = m_nBlockSize - 1; i >= 0; i--, pNode--) {
       pNode->pNext = m_pNodeFree;
@@ skipping 25 matching lines @@
 }
 FX_POSITION CFX_PtrList::Find(void* searchValue, FX_POSITION startAfter) const {
   CNode* pNode = (CNode*)startAfter;
   pNode = pNode ? pNode->pNext : m_pNodeHead;
   for (; pNode; pNode = pNode->pNext) {
     if (pNode->data == searchValue)
       return (FX_POSITION)pNode;
   }
   return NULL;
 }