Make CPDF_PageContentGenerator methods take object numbers

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/edit/cpdf_pagecontentgenerator.h"
 
 #include "core/fpdfapi/edit/cpdf_creator.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
@@ skipping 41 matching lines @@
   if (pContent)
     pPageDict->RemoveFor("Contents");
 
   CPDF_Stream* pStream = new CPDF_Stream;
   pStream->SetData(buf.GetBuffer(), buf.GetLength());
   pPageDict->SetReferenceFor("Contents", m_pDocument,
                              m_pDocument->AddIndirectObject(pStream));
 }
 
 CFX_ByteString CPDF_PageContentGenerator::RealizeResource(
-    CPDF_Object* pResourceObj,
+    uint32_t dwResourceObjNum,
     const CFX_ByteString& bsType) {
+  ASSERT(dwResourceObjNum);
   if (!m_pPage->m_pResources) {
     m_pPage->m_pResources =
         new CPDF_Dictionary(m_pDocument->GetByteStringPool());
     m_pPage->m_pFormDict->SetReferenceFor(
         "Resources", m_pDocument,
         m_pDocument->AddIndirectObject(m_pPage->m_pResources));
   }
   CPDF_Dictionary* pResList = m_pPage->m_pResources->GetDictFor(bsType);
   if (!pResList) {
     pResList = new CPDF_Dictionary(m_pDocument->GetByteStringPool());
     m_pPage->m_pResources->SetFor(bsType, pResList);
   }
   CFX_ByteString name;
   int idnum = 1;
   while (1) {
     name.Format("FX%c%d", bsType[0], idnum);
     if (!pResList->KeyExist(name)) {
       break;
     }
     idnum++;
   }
-  pResList->SetReferenceFor(name, m_pDocument,
-                            m_pDocument->AddIndirectObject(pResourceObj));
+  pResList->SetReferenceFor(name, m_pDocument, dwResourceObjNum);
   return name;
 }
 
 void CPDF_PageContentGenerator::ProcessImage(CFX_ByteTextBuf& buf,
                                              CPDF_ImageObject* pImageObj) {
   if ((pImageObj->m_Matrix.a == 0 && pImageObj->m_Matrix.b == 0) ||
       (pImageObj->m_Matrix.c == 0 && pImageObj->m_Matrix.d == 0)) {
     return;
   }
   buf << "q " << pImageObj->m_Matrix << " cm ";
+
   CPDF_Image* pImage = pImageObj->GetImage();
-  if (!pImage->IsInline()) {
-    CPDF_Stream* pStream = pImage->GetStream();
-    uint32_t dwSavedObjNum = pStream->GetObjNum();
-    CFX_ByteString name = RealizeResource(pStream, "XObject");
-    if (dwSavedObjNum == 0) {
-      pImageObj->SetUnownedImage(m_pDocument->GetPageData()->GetImage(pStream));
-    }
-    buf << "/" << PDF_NameEncode(name) << " Do Q\n";
+  if (pImage->IsInline())
+    return;
+
+  CPDF_Stream* pStream = pImage->GetStream();
+  bool bWasInline = pStream->IsInline();
+  if (bWasInline) {
+    pStream = ToStream(pStream->Clone().release());

[Tom Sepez, 2016/11/10 21:15:26]

Note: this is the clone that avoids the UAF.  The setunownedimage below clobbers
the original stream and if this is called again on the same image, we get issue.

+    m_pDocument->AddIndirectObject(pStream);
   }
+
+  CFX_ByteString name = RealizeResource(pStream->GetObjNum(), "XObject");
+  if (bWasInline)
+    pImageObj->SetUnownedImage(m_pDocument->GetPageData()->GetImage(pStream));
+
+  buf << "/" << PDF_NameEncode(name) << " Do Q\n";
 }
 
 void CPDF_PageContentGenerator::ProcessForm(CFX_ByteTextBuf& buf,
                                             const uint8_t* data,
                                             uint32_t size,
                                             CFX_Matrix& matrix) {
   if (!data || !size)
     return;
 
+  buf << "q " << matrix << " cm ";
+
+  CFX_FloatRect bbox = m_pPage->GetPageBBox();
+  matrix.TransformRect(bbox);
+
   CPDF_Dictionary* pFormDict =
       new CPDF_Dictionary(m_pDocument->GetByteStringPool());
   pFormDict->SetNameFor("Type", "XObject");
   pFormDict->SetNameFor("Subtype", "Form");
-
-  CFX_FloatRect bbox = m_pPage->GetPageBBox();
-  matrix.TransformRect(bbox);
   pFormDict->SetRectFor("BBox", bbox);
 
   CPDF_Stream* pStream = new CPDF_Stream;
   pStream->InitStream(data, size, pFormDict);
-  buf << "q " << matrix << " cm ";
 
-  CFX_ByteString name = RealizeResource(pStream, "XObject");
+  CFX_ByteString name =
+      RealizeResource(m_pDocument->AddIndirectObject(pStream), "XObject");
   buf << "/" << PDF_NameEncode(name) << " Do Q\n";
 }
 
 void CPDF_PageContentGenerator::TransformContent(CFX_Matrix& matrix) {
   CPDF_Dictionary* pDict = m_pPage->m_pFormDict;
   CPDF_Object* pContent =
       pDict ? pDict->GetDirectObjectFor("Contents") : nullptr;
   if (!pContent)
     return;
 
@@ skipping 28 matching lines @@
   } else if (CPDF_Stream* pStream = pContent->AsStream()) {
     CPDF_StreamAcc contentStream;
     contentStream.LoadAllData(pStream);
     ProcessForm(buf, contentStream.GetData(), contentStream.GetSize(), matrix);
   }
   CPDF_Stream* pStream = new CPDF_Stream;
   pStream->SetData(buf.GetBuffer(), buf.GetLength());
   m_pPage->m_pFormDict->SetReferenceFor(
       "Contents", m_pDocument, m_pDocument->AddIndirectObject(pStream));
 }