Pdfium: Fix fonts leaking on ClosePage.

core/fpdfapi/fpdf_page/fpdf_page_doc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <algorithm>
 #include <set>
@@ skipping 196 matching lines @@
 
   auto it = m_FontMap.find(pFontDict);
   if (it == m_FontMap.end())
     return;
 
   CPDF_CountedFont* pFontData = it->second;
   if (!pFontData->get())
     return;
 
   pFontData->RemoveRef();
-  if (pFontData->use_count() != 0)
+  if (pFontData->use_count() > 1)
     return;
 
+  // We have font data only in m_FontMap cache. Clean it.
   pFontData->clear();
 }
 
 CPDF_ColorSpace* CPDF_DocPageData::GetColorSpace(
     CPDF_Object* pCSObj,
     const CPDF_Dictionary* pResources) {
   std::set<CPDF_Object*> visited;
   return GetColorSpaceImpl(pCSObj, pResources, &visited);
 }
 
@@ skipping 93 matching lines @@
 
   auto it = m_ColorSpaceMap.find(pColorSpace);
   if (it == m_ColorSpaceMap.end())
     return;
 
   CPDF_CountedColorSpace* pCountedColorSpace = it->second;
   if (!pCountedColorSpace->get())
     return;
 
   pCountedColorSpace->RemoveRef();
-  if (pCountedColorSpace->use_count() != 0)
+  if (pCountedColorSpace->use_count() > 1)
     return;
 
+  // We have item only in m_ColorSpaceMap cache. Clean it.
   pCountedColorSpace->get()->ReleaseCS();
   pCountedColorSpace->reset(nullptr);
 }
 
 CPDF_Pattern* CPDF_DocPageData::GetPattern(CPDF_Object* pPatternObj,
                                            FX_BOOL bShading,
                                            const CFX_Matrix& matrix) {
   if (!pPatternObj)
     return nullptr;
 
@@ skipping 38 matching lines @@
 
   auto it = m_PatternMap.find(pPatternObj);
   if (it == m_PatternMap.end())
     return;
 
   CPDF_CountedPattern* pPattern = it->second;
   if (!pPattern->get())
     return;
 
   pPattern->RemoveRef();
-  if (pPattern->use_count() != 0)
+  if (pPattern->use_count() > 1)
     return;
 
+  // We have item only in m_PatternMap cache. Clean it.
   pPattern->clear();
 }
 
 CPDF_Image* CPDF_DocPageData::GetImage(CPDF_Object* pImageStream) {
   if (!pImageStream)
     return nullptr;
 
   const uint32_t dwImageObjNum = pImageStream->GetObjNum();
   auto it = m_ImageMap.find(dwImageObjNum);
   if (it != m_ImageMap.end())
@@ skipping 15 matching lines @@
 
   auto it = m_ImageMap.find(dwObjNum);
   if (it == m_ImageMap.end())
     return;
 
   CPDF_CountedImage* pCountedImage = it->second;
   if (!pCountedImage)
     return;
 
   pCountedImage->RemoveRef();
-  if (pCountedImage->use_count() != 0)
+  if (pCountedImage->use_count() > 1)
     return;
 
+  // We have item only in m_ImageMap cache. Clean it.
   delete pCountedImage->get();
   delete pCountedImage;
   m_ImageMap.erase(it);
 }
 
 CPDF_IccProfile* CPDF_DocPageData::GetIccProfile(
     CPDF_Stream* pIccProfileStream) {
   if (!pIccProfileStream)
     return nullptr;
 
   auto it = m_IccProfileMap.find(pIccProfileStream);
   if (it != m_IccProfileMap.end())
     return it->second->AddRef();
 
   CPDF_StreamAcc stream;
   stream.LoadAllData(pIccProfileStream, FALSE);
   uint8_t digest[20];
   CRYPT_SHA1Generate(stream.GetData(), stream.GetSize(), digest);
   CFX_ByteString bsDigest(digest, 20);
   auto hash_it = m_HashProfileMap.find(bsDigest);
   if (hash_it != m_HashProfileMap.end()) {
     auto it_copied_stream = m_IccProfileMap.find(hash_it->second);
-    return it_copied_stream->second->AddRef();
+    if (it_copied_stream != m_IccProfileMap.end())
+      return it_copied_stream->second->AddRef();

[npm, 2016/09/14 23:07:59]

If the code reaches to this point but the if statement is false,
m_HashProfileMap[bsDigest] is replaced below even though it is not null. Is that
fine?

[snake, 2016/09/15 10:39:25]

Yes.
CPDF_DocPageData is not owned pIccProfileStream. HashProfileMap is just
container to store hash from raw stream data. And if we have two different
pointers pIccProfileStream with identical data, we create just one profile for
both.

   }
   CPDF_IccProfile* pProfile =
       new CPDF_IccProfile(stream.GetData(), stream.GetSize());
   CPDF_CountedIccProfile* ipData = new CPDF_CountedIccProfile(pProfile);
   m_IccProfileMap[pIccProfileStream] = ipData;
   m_HashProfileMap[bsDigest] = pIccProfileStream;
   return ipData->AddRef();
 }
 
 void CPDF_DocPageData::ReleaseIccProfile(const CPDF_IccProfile* pIccProfile) {
   ASSERT(pIccProfile);
 
   for (auto it = m_IccProfileMap.begin(); it != m_IccProfileMap.end(); ++it) {
     CPDF_CountedIccProfile* profile = it->second;
     if (profile->get() != pIccProfile)
       continue;
 
     profile->RemoveRef();
-    if (profile->use_count() == 0) {
+    if (profile->use_count() == 1) {
+      // We have item only in m_IccProfileMap cache. Clean it.
       delete profile->get();
       delete profile;
       m_IccProfileMap.erase(it);
       return;
     }
   }
 }
 
 CPDF_StreamAcc* CPDF_DocPageData::GetFontFileStreamAcc(
     CPDF_Stream* pFontStream) {
@@ skipping 24 matching lines @@
 
   auto it = m_FontFileMap.find(pFontStream);
   if (it == m_FontFileMap.end())
     return;
 
   CPDF_CountedStreamAcc* pCountedStream = it->second;
   if (!pCountedStream)
     return;
 
   pCountedStream->RemoveRef();
-  if (pCountedStream->use_count() != 0)
+  if (pCountedStream->use_count() > 1)
     return;
 
+  // We have item only in m_FontFileMap cache. Clean it.
   delete pCountedStream->get();
   delete pCountedStream;
   m_FontFileMap.erase(it);
 }
 
 CPDF_CountedColorSpace* CPDF_DocPageData::FindColorSpacePtr(
     CPDF_Object* pCSObj) const {
   if (!pCSObj)
     return nullptr;
 
   auto it = m_ColorSpaceMap.find(pCSObj);
   return it != m_ColorSpaceMap.end() ? it->second : nullptr;
 }
 
 CPDF_CountedPattern* CPDF_DocPageData::FindPatternPtr(
     CPDF_Object* pPatternObj) const {
   if (!pPatternObj)
     return nullptr;
 
   auto it = m_PatternMap.find(pPatternObj);
   return it != m_PatternMap.end() ? it->second : nullptr;
 }