Pdfium: Fix fonts leaking on ClosePage.

core/fpdfapi/fpdf_page/fpdf_page_doc.cpp

Index: core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
diff --git a/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp b/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
index fa242ffb857f0c74801dba1fc6f205845aba7566..8a58d6327c7b13b08a9862c1541caee22578bdd8 100644
--- a/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
+++ b/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
@@ -214,9 +214,10 @@ void CPDF_DocPageData::ReleaseFont(const CPDF_Dictionary* pFontDict) {
     return;
 
   pFontData->RemoveRef();
-  if (pFontData->use_count() != 0)
+  if (pFontData->use_count() > 1)
     return;
 
+  // We have font data only in m_FontMap cache. Clean it.
   pFontData->clear();
 }
 
@@ -330,9 +331,10 @@ void CPDF_DocPageData::ReleaseColorSpace(const CPDF_Object* pColorSpace) {
     return;
 
   pCountedColorSpace->RemoveRef();
-  if (pCountedColorSpace->use_count() != 0)
+  if (pCountedColorSpace->use_count() > 1)
     return;
 
+  // We have item only in m_ColorSpaceMap cache. Clean it.
   pCountedColorSpace->get()->ReleaseCS();
   pCountedColorSpace->reset(nullptr);
 }
@@ -391,9 +393,10 @@ void CPDF_DocPageData::ReleasePattern(const CPDF_Object* pPatternObj) {
     return;
 
   pPattern->RemoveRef();
-  if (pPattern->use_count() != 0)
+  if (pPattern->use_count() > 1)
     return;
 
+  // We have item only in m_PatternMap cache. Clean it.
   pPattern->clear();
 }
 
@@ -429,9 +432,10 @@ void CPDF_DocPageData::ReleaseImage(const CPDF_Object* pImageStream) {
     return;
 
   pCountedImage->RemoveRef();
-  if (pCountedImage->use_count() != 0)
+  if (pCountedImage->use_count() > 1)
     return;
 
+  // We have item only in m_ImageMap cache. Clean it.
   delete pCountedImage->get();
   delete pCountedImage;
   m_ImageMap.erase(it);
@@ -454,7 +458,8 @@ CPDF_IccProfile* CPDF_DocPageData::GetIccProfile(
   auto hash_it = m_HashProfileMap.find(bsDigest);
   if (hash_it != m_HashProfileMap.end()) {
     auto it_copied_stream = m_IccProfileMap.find(hash_it->second);
-    return it_copied_stream->second->AddRef();
+    if (it_copied_stream != m_IccProfileMap.end())
+      return it_copied_stream->second->AddRef();

[npm, 2016/09/14 23:07:59]

If the code reaches to this point but the if statement is false,
m_HashProfileMap[bsDigest] is replaced below even though it is not null. Is that
fine?

[snake, 2016/09/15 10:39:25]

Yes.
CPDF_DocPageData is not owned pIccProfileStream. HashProfileMap is just
container to store hash from raw stream data. And if we have two different
pointers pIccProfileStream with identical data, we create just one profile for
both.

   }
   CPDF_IccProfile* pProfile =
       new CPDF_IccProfile(stream.GetData(), stream.GetSize());
@@ -473,7 +478,8 @@ void CPDF_DocPageData::ReleaseIccProfile(const CPDF_IccProfile* pIccProfile) {
       continue;
 
     profile->RemoveRef();
-    if (profile->use_count() == 0) {
+    if (profile->use_count() == 1) {
+      // We have item only in m_IccProfileMap cache. Clean it.
       delete profile->get();
       delete profile;
       m_IccProfileMap.erase(it);
@@ -518,9 +524,10 @@ void CPDF_DocPageData::ReleaseFontFileStreamAcc(
     return;
 
   pCountedStream->RemoveRef();
-  if (pCountedStream->use_count() != 0)
+  if (pCountedStream->use_count() > 1)
     return;
 
+  // We have item only in m_FontFileMap cache. Clean it.
   delete pCountedStream->get();
   delete pCountedStream;
   m_FontFileMap.erase(it);