Fix nullptr dereference in FPDF_GenerateAP().

core/fpdfdoc/cpvt_generateap.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfdoc/cpvt_generateap.h"
 
+#include <algorithm>
+
 #include "core/fpdfapi/fpdf_font/include/cpdf_font.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_document.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_simple_parser.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h"
 #include "core/fpdfdoc/cpvt_color.h"
 #include "core/fpdfdoc/cpvt_fontmap.h"
 #include "core/fpdfdoc/include/cpdf_annot.h"
 #include "core/fpdfdoc/include/cpdf_formfield.h"
@@ skipping 643 matching lines @@
 
   return sAppStream.MakeString();
 }
 
 }  // namespace
 
 bool FPDF_GenerateAP(CPDF_Document* pDoc, CPDF_Dictionary* pAnnotDict) {
   if (!pAnnotDict || pAnnotDict->GetStringFor("Subtype") != "Widget")
     return false;
 
-  CFX_ByteString field_type = FPDF_GetFieldAttr(pAnnotDict, "FT")->GetString();
-  uint32_t flags = FPDF_GetFieldAttr(pAnnotDict, "Ff")
-                       ? FPDF_GetFieldAttr(pAnnotDict, "Ff")->GetInteger()
-                       : 0;
-  if (field_type == "Tx") {
+  CPDF_Object* pFieldTypeObj = FPDF_GetFieldAttr(pAnnotDict, "FT");
+  if (!pFieldTypeObj)
+    return false;
+
+  CFX_ByteString field_type = pFieldTypeObj->GetString();
+  if (field_type == "Tx")
     return CPVT_GenerateAP::GenerateTextFieldAP(pDoc, pAnnotDict);
-  }
+
+  CPDF_Object* pFieldFlagsObj = FPDF_GetFieldAttr(pAnnotDict, "Ff");
+  uint32_t flags = pFieldFlagsObj ? pFieldFlagsObj->GetInteger() : 0;
+
   if (field_type == "Ch") {
     return (flags & (1 << 17))
                ? CPVT_GenerateAP::GenerateComboBoxAP(pDoc, pAnnotDict)
                : CPVT_GenerateAP::GenerateListBoxAP(pDoc, pAnnotDict);
   }
+
   if (field_type == "Btn") {
     if (!(flags & (1 << 16))) {
       if (!pAnnotDict->KeyExist("AS")) {
         if (CPDF_Dictionary* pParentDict = pAnnotDict->GetDictFor("Parent")) {
           if (pParentDict->KeyExist("AS")) {
             pAnnotDict->SetStringFor("AS", pParentDict->GetStringFor("AS"));
           }
         }
       }
     }
   }
+
   return false;
 }
 
 // Static.
 bool CPVT_GenerateAP::GenerateComboBoxAP(CPDF_Document* pDoc,
                                          CPDF_Dictionary* pAnnotDict) {
   return GenerateWidgetAP(pDoc, pAnnotDict, 1);
 }
 
 // Static.
@@ skipping 637 matching lines @@
                                                  int32_t nFontIndex,
                                                  FX_FLOAT fFontSize) {
   CFX_ByteTextBuf sRet;
   if (pFontMap) {
     CFX_ByteString sFontAlias = pFontMap->GetPDFFontAlias(nFontIndex);
     if (sFontAlias.GetLength() > 0 && fFontSize > 0)
       sRet << "/" << sFontAlias << " " << fFontSize << " Tf\n";
   }
   return sRet.MakeString();
 }