Fix leak in CPDF_StreamContentParser::AddTextObject().

core/fpdfapi/fpdf_page/cpdf_clippath.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/include/cpdf_clippath.h"
 
+#include <utility>
+
 #include "core/fpdfapi/fpdf_page/include/cpdf_textobject.h"
 
 #define FPDF_CLIPPATH_MAX_TEXTS 1024
 
 CFX_FloatRect CPDF_ClipPath::GetClipBox() const {
   CFX_FloatRect rect;
   FX_BOOL bStarted = FALSE;
   int count = GetPathCount();
   if (count) {
     rect = GetPath(0).GetBoundingBox();
@@ skipping 23 matching lines @@
           bLayerStarted = TRUE;
         } else {
           layer_rect.Union(CFX_FloatRect(pTextObj->GetBBox(nullptr)));
         }
       }
     }
   }
   return rect;
 }
 
-void CPDF_ClipPath::AppendPath(CPDF_Path path, int type, FX_BOOL bAutoMerge) {
+void CPDF_ClipPath::AppendPath(CPDF_Path path, uint8_t type, bool bAutoMerge) {
   CPDF_ClipPathData* pData = GetModify();
-  if (pData->m_PathCount && bAutoMerge) {
-    CPDF_Path old_path = pData->m_pPathList[pData->m_PathCount - 1];
+  if (!pData->m_PathList.empty() && bAutoMerge) {
+    CPDF_Path old_path = pData->m_PathList.back();
     if (old_path.IsRect()) {
       CFX_FloatRect old_rect(old_path.GetPointX(0), old_path.GetPointY(0),
                              old_path.GetPointX(2), old_path.GetPointY(2));
       CFX_FloatRect new_rect = path.GetBoundingBox();
       if (old_rect.Contains(new_rect)) {
-        pData->m_PathCount--;
-        pData->m_pPathList[pData->m_PathCount].SetNull();
+        pData->m_PathList.back().SetNull();

[Tom Sepez, 2016/05/19 18:32:03]

Doesn't the dtor invoked by pop_back on the next line cover this?

[Lei Zhang, 2016/05/19 20:44:26]

Done.

+        pData->m_PathList.pop_back();
       }
     }
   }
-  if (pData->m_PathCount % 8 == 0) {
-    CPDF_Path* pNewPath = new CPDF_Path[pData->m_PathCount + 8];
-    for (int i = 0; i < pData->m_PathCount; i++) {
-      pNewPath[i] = pData->m_pPathList[i];
-    }
-    delete[] pData->m_pPathList;
-    uint8_t* pNewType = FX_Alloc(uint8_t, pData->m_PathCount + 8);
-    FXSYS_memcpy(pNewType, pData->m_pTypeList, pData->m_PathCount);
-    FX_Free(pData->m_pTypeList);
-    pData->m_pPathList = pNewPath;
-    pData->m_pTypeList = pNewType;
-  }
-  pData->m_pPathList[pData->m_PathCount] = path;
-  pData->m_pTypeList[pData->m_PathCount] = (uint8_t)type;
-  pData->m_PathCount++;
+  pData->m_PathList.push_back(path);

[Tom Sepez, 2016/05/19 18:32:03]

you don't suppose we could have a single vector<std::pair> rather than two
parallel vectors?

[Lei Zhang, 2016/05/19 20:44:26]

Done.

+  pData->m_TypeList.push_back(type);
 }
 
-void CPDF_ClipPath::DeletePath(int index) {

[Lei Zhang, 2016/05/19 17:28:45]

Dead code.

+void CPDF_ClipPath::AppendTexts(
+    std::vector<std::unique_ptr<CPDF_TextObject>>* pTexts) {
   CPDF_ClipPathData* pData = GetModify();
-  if (index >= pData->m_PathCount) {
-    return;
+  if (pData->m_TextList.size() + pTexts->size() <= FPDF_CLIPPATH_MAX_TEXTS) {
+    for (size_t i = 0; i < pTexts->size(); i++)
+      pData->m_TextList.push_back(std::move((*pTexts)[i]));
+    pData->m_TextList.push_back(std::unique_ptr<CPDF_TextObject>());
   }
-  pData->m_pPathList[index].SetNull();
-  for (int i = index; i < pData->m_PathCount - 1; i++) {
-    pData->m_pPathList[i] = pData->m_pPathList[i + 1];
-  }
-  pData->m_pPathList[pData->m_PathCount - 1].SetNull();
-  FXSYS_memmove(pData->m_pTypeList + index, pData->m_pTypeList + index + 1,
-                pData->m_PathCount - index - 1);
-  pData->m_PathCount--;
-}
-
-void CPDF_ClipPath::AppendTexts(CPDF_TextObject** pTexts, int count) {
-  CPDF_ClipPathData* pData = GetModify();
-  if (pData->m_TextCount + count > FPDF_CLIPPATH_MAX_TEXTS) {
-    for (int i = 0; i < count; i++) {
-      delete pTexts[i];
-    }
-    return;
-  }
-  CPDF_TextObject** pNewList =
-      FX_Alloc(CPDF_TextObject*, pData->m_TextCount + count + 1);
-  if (pData->m_pTextList) {
-    FXSYS_memcpy(pNewList, pData->m_pTextList,
-                 pData->m_TextCount * sizeof(CPDF_TextObject*));
-    FX_Free(pData->m_pTextList);
-  }
-  pData->m_pTextList = pNewList;
-  for (int i = 0; i < count; i++) {
-    pData->m_pTextList[pData->m_TextCount + i] = pTexts[i];
-  }
-  pData->m_pTextList[pData->m_TextCount + count] = NULL;
-  pData->m_TextCount += count + 1;
+  pTexts->clear();
 }
 
 void CPDF_ClipPath::Transform(const CFX_Matrix& matrix) {
   CPDF_ClipPathData* pData = GetModify();
-  int i;
-  for (i = 0; i < pData->m_PathCount; i++) {
-    pData->m_pPathList[i].Transform(&matrix);
+  for (auto& path : pData->m_PathList)
+    path.Transform(&matrix);
+  for (auto& text : pData->m_TextList) {
+    if (text)
+      text->Transform(matrix);
   }
-  for (i = 0; i < pData->m_TextCount; i++)
-    if (pData->m_pTextList[i]) {
-      pData->m_pTextList[i]->Transform(matrix);
-    }
 }