Fix leak in CPDF_StreamContentParser::AddTextObject().

core/fpdfapi/fpdf_page/fpdf_page_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <vector>
 
@@ skipping 795 matching lines @@
 
   int count = m_CurContentMark.GetObject()->CountItems();
   if (count == 1) {
     m_CurContentMark.SetNull();
     return;
   }
   m_CurContentMark.GetModify()->DeleteLastMark();
 }
 
 void CPDF_StreamContentParser::Handle_EndText() {
-  int count = m_ClipTextList.GetSize();
-  if (count == 0) {
+  if (m_ClipTextList.empty())
     return;
-  }
-  if (m_pCurStates->m_TextState.GetObject()->m_TextMode < 4) {
-    for (int i = 0; i < count; i++) {
-      delete m_ClipTextList.GetAt(i);
-    }
-  } else {
-    m_pCurStates->m_ClipPath.AppendTexts(m_ClipTextList.GetData(), count);
-  }
-  m_ClipTextList.RemoveAll();
+
+  if (m_pCurStates->m_TextState.GetObject()->m_TextMode >= 4)
+    m_pCurStates->m_ClipPath.AppendTexts(&m_ClipTextList);
+  m_ClipTextList.clear();
 }
 
 void CPDF_StreamContentParser::Handle_FillPath() {
   AddPathObject(FXFILL_WINDING, FALSE);
 }
 
 void CPDF_StreamContentParser::Handle_FillPathOld() {
   AddPathObject(FXFILL_WINDING, FALSE);
 }
 
@@ skipping 439 matching lines @@
     pText->SetSegments(pStrs, pKerning, nsegs);
     pText->m_PosX = m_pCurStates->m_TextX;
     pText->m_PosY = m_pCurStates->m_TextY + m_pCurStates->m_TextRise;
     ConvertTextSpace(pText->m_PosX, pText->m_PosY);
     FX_FLOAT x_advance;
     FX_FLOAT y_advance;
     pText->CalcPositionData(&x_advance, &y_advance,
                             m_pCurStates->m_TextHorzScale, m_Level);
     m_pCurStates->m_TextX += x_advance;
     m_pCurStates->m_TextY += y_advance;
-    if (textmode > 3)
-      m_ClipTextList.Add(pText->Clone());

[Lei Zhang, 2016/05/19 17:28:46]

CPDF_StreamContentParser::Handle_EndText() above sometimes forget to delete
this.

[Tom Sepez, 2016/05/19 18:32:03]

I'm being dense and not seeing it.  Looks like either it gets delete at 822, or
it gets passed to appendTexts, which either appends it taking ownership or
deletes it itself.

[Lei Zhang, 2016/05/19 20:44:26]

Oh, I read it wrong. Looking again, it's due to Handle_EndText() not being
called at all.

+    if (textmode > 3) {
+      m_ClipTextList.push_back(
+          std::unique_ptr<CPDF_TextObject>(pText->Clone()));
+    }
     m_pObjectHolder->GetPageObjectList()->push_back(std::move(pText));
   }
   if (pKerning && pKerning[nsegs - 1] != 0) {
     if (!pFont->IsVertWriting()) {
       m_pCurStates->m_TextX -=
           (pKerning[nsegs - 1] * m_pCurStates->m_TextState.GetFontSize()) /
           1000;
     } else {
       m_pCurStates->m_TextY -=
           (pKerning[nsegs - 1] * m_pCurStates->m_TextState.GetFontSize()) /
@@ skipping 177 matching lines @@
     }
     m_pPathPoints = pNewPoints;
     m_PathAllocSize = newsize;
   }
   m_pPathPoints[m_PathPointCount - 1].m_Flag = flag;
   m_pPathPoints[m_PathPointCount - 1].m_PointX = x;
   m_pPathPoints[m_PathPointCount - 1].m_PointY = y;
 }
 
 void CPDF_StreamContentParser::AddPathObject(int FillType, FX_BOOL bStroke) {
-  int PathPointCount = m_PathPointCount, PathClipType = m_PathClipType;
+  int PathPointCount = m_PathPointCount;
+  uint8_t PathClipType = m_PathClipType;
   m_PathPointCount = 0;
   m_PathClipType = 0;
   if (PathPointCount <= 1) {
     if (PathPointCount && PathClipType) {
       CPDF_Path path;
       path.New()->AppendRect(0, 0, 0, 0);
       m_pCurStates->m_ClipPath.AppendPath(path, FXFILL_WINDING, TRUE);
     }
     return;
   }
@@ skipping 207 matching lines @@
         } else {
           PDF_ReplaceAbbr(pElement);
         }
       }
       break;
     }
     default:
       break;
   }
 }