Ensure CPDF_CountedObjects only made from owned references.

core/fpdfapi/page/cpdf_docpagedata.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
 
 #include <algorithm>
 #include <memory>
 #include <set>
+#include <utility>
 
 #include "core/fdrm/crypto/fx_crypt.h"
 #include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/font/cpdf_type1font.h"
 #include "core/fpdfapi/font/font_int.h"
 #include "core/fpdfapi/page/cpdf_image.h"
 #include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/page/cpdf_pattern.h"
 #include "core/fpdfapi/page/cpdf_shadingpattern.h"
 #include "core/fpdfapi/page/cpdf_tilingpattern.h"
@@ skipping 114 matching lines @@
     pFontData = it->second;
     if (pFontData->get()) {
       return pFontData->AddRef();
     }
   }
   std::unique_ptr<CPDF_Font> pFont = CPDF_Font::Create(m_pPDFDoc, pFontDict);
   if (!pFont)
     return nullptr;
 
   if (pFontData) {
-    pFontData->reset(pFont.release());
+    pFontData->reset(std::move(pFont));
   } else {
-    pFontData = new CPDF_CountedFont(pFont.release());
+    pFontData = new CPDF_CountedFont(std::move(pFont));
     m_FontMap[pFontDict] = pFontData;
   }
   return pFontData->AddRef();
 }
 
 CPDF_Font* CPDF_DocPageData::GetStandardFont(const CFX_ByteString& fontName,
                                              CPDF_FontEncoding* pEncoding) {
   if (fontName.IsEmpty())
     return nullptr;
 
@@ skipping 24 matching lines @@
   pDict->SetNewFor<CPDF_Name>("BaseFont", fontName);
   if (pEncoding) {
     pDict->SetFor("Encoding",
                   pEncoding->Realize(m_pPDFDoc->GetByteStringPool()));
   }
 
   std::unique_ptr<CPDF_Font> pFont = CPDF_Font::Create(m_pPDFDoc, pDict);
   if (!pFont)
     return nullptr;
 
-  CPDF_CountedFont* fontData = new CPDF_CountedFont(pFont.release());
+  CPDF_CountedFont* fontData = new CPDF_CountedFont(std::move(pFont));
   m_FontMap[pDict] = fontData;
   return fontData->AddRef();
 }
 
 void CPDF_DocPageData::ReleaseFont(const CPDF_Dictionary* pFontDict) {
   if (!pFontDict)
     return;
 
   auto it = m_FontMap.find(pFontDict);
   if (it == m_FontMap.end())
@@ skipping 82 matching lines @@
     if (csData->get()) {
       return csData->AddRef();
     }
   }
 
   std::unique_ptr<CPDF_ColorSpace> pCS =
       CPDF_ColorSpace::Load(m_pPDFDoc, pArray);
   if (!pCS)
     return nullptr;
 
-  if (!csData) {
-    csData = new CPDF_CountedColorSpace(pCS.release());
+  if (csData) {
+    csData->reset(std::move(pCS));
+  } else {
+    csData = new CPDF_CountedColorSpace(std::move(pCS));
     m_ColorSpaceMap[pCSObj] = csData;
-  } else {
-    csData->reset(pCS.release());
   }
   return csData->AddRef();
 }
 
 CPDF_ColorSpace* CPDF_DocPageData::GetCopiedColorSpace(CPDF_Object* pCSObj) {
   if (!pCSObj)
     return nullptr;
 
   auto it = m_ColorSpaceMap.find(pCSObj);
   if (it != m_ColorSpaceMap.end())
@@ skipping 30 matching lines @@
     return nullptr;
 
   CPDF_CountedPattern* ptData = nullptr;
   auto it = m_PatternMap.find(pPatternObj);
   if (it != m_PatternMap.end()) {
     ptData = it->second;
     if (ptData->get()) {
       return ptData->AddRef();
     }
   }
-  CPDF_Pattern* pPattern = nullptr;
+  std::unique_ptr<CPDF_Pattern> pPattern;
   if (bShading) {
-    pPattern = new CPDF_ShadingPattern(m_pPDFDoc, pPatternObj, true, matrix);
+    pPattern = pdfium::MakeUnique<CPDF_ShadingPattern>(m_pPDFDoc, pPatternObj,
+                                                       true, matrix);
   } else {
     CPDF_Dictionary* pDict = pPatternObj ? pPatternObj->GetDict() : nullptr;
     if (pDict) {
       int type = pDict->GetIntegerFor("PatternType");
       if (type == CPDF_Pattern::TILING) {
-        pPattern = new CPDF_TilingPattern(m_pPDFDoc, pPatternObj, matrix);
+        pPattern = pdfium::MakeUnique<CPDF_TilingPattern>(m_pPDFDoc,
+                                                          pPatternObj, matrix);
       } else if (type == CPDF_Pattern::SHADING) {
-        pPattern =
-            new CPDF_ShadingPattern(m_pPDFDoc, pPatternObj, false, matrix);
+        pPattern = pdfium::MakeUnique<CPDF_ShadingPattern>(
+            m_pPDFDoc, pPatternObj, false, matrix);
       }
     }
   }
   if (!pPattern)
     return nullptr;
 
-  if (!ptData) {
-    ptData = new CPDF_CountedPattern(pPattern);
+  if (ptData) {
+    ptData->reset(std::move(pPattern));
+  } else {
+    ptData = new CPDF_CountedPattern(std::move(pPattern));
     m_PatternMap[pPatternObj] = ptData;
-  } else {
-    ptData->reset(pPattern);
   }
   return ptData->AddRef();
 }
 
 void CPDF_DocPageData::ReleasePattern(const CPDF_Object* pPatternObj) {
   if (!pPatternObj)
     return;
 
   auto it = m_PatternMap.find(pPatternObj);
   if (it == m_PatternMap.end())
@@ skipping 10 matching lines @@
   // We have item only in m_PatternMap cache. Clean it.
   pPattern->clear();
 }
 
 CPDF_Image* CPDF_DocPageData::GetImage(uint32_t dwStreamObjNum) {
   ASSERT(dwStreamObjNum);
   auto it = m_ImageMap.find(dwStreamObjNum);
   if (it != m_ImageMap.end())
     return it->second->AddRef();
 
-  CPDF_CountedImage* pCountedImage =
-      new CPDF_CountedImage(new CPDF_Image(m_pPDFDoc, dwStreamObjNum));
+  CPDF_CountedImage* pCountedImage = new CPDF_CountedImage(
+      pdfium::MakeUnique<CPDF_Image>(m_pPDFDoc, dwStreamObjNum));
   m_ImageMap[dwStreamObjNum] = pCountedImage;
   return pCountedImage->AddRef();
 }
 
 void CPDF_DocPageData::ReleaseImage(uint32_t dwStreamObjNum) {
   ASSERT(dwStreamObjNum);
   auto it = m_ImageMap.find(dwStreamObjNum);
   if (it == m_ImageMap.end())
     return;
 
@@ skipping 24 matching lines @@
   stream.LoadAllData(pIccProfileStream, false);
   uint8_t digest[20];
   CRYPT_SHA1Generate(stream.GetData(), stream.GetSize(), digest);
   CFX_ByteString bsDigest(digest, 20);
   auto hash_it = m_HashProfileMap.find(bsDigest);
   if (hash_it != m_HashProfileMap.end()) {
     auto it_copied_stream = m_IccProfileMap.find(hash_it->second);
     if (it_copied_stream != m_IccProfileMap.end())
       return it_copied_stream->second->AddRef();
   }
-  CPDF_IccProfile* pProfile =
-      new CPDF_IccProfile(stream.GetData(), stream.GetSize());
-  CPDF_CountedIccProfile* ipData = new CPDF_CountedIccProfile(pProfile);
+  CPDF_CountedIccProfile* ipData = new CPDF_CountedIccProfile(
+      pdfium::MakeUnique<CPDF_IccProfile>(stream.GetData(), stream.GetSize()));
   m_IccProfileMap[pIccProfileStream] = ipData;
   m_HashProfileMap[bsDigest] = pIccProfileStream;
   return ipData->AddRef();
 }
 
 void CPDF_DocPageData::ReleaseIccProfile(const CPDF_IccProfile* pIccProfile) {
   ASSERT(pIccProfile);
 
   for (auto it = m_IccProfileMap.begin(); it != m_IccProfileMap.end(); ++it) {
     CPDF_CountedIccProfile* profile = it->second;
@@ skipping 18 matching lines @@
   auto it = m_FontFileMap.find(pFontStream);
   if (it != m_FontFileMap.end())
     return it->second->AddRef();
 
   CPDF_Dictionary* pFontDict = pFontStream->GetDict();
   int32_t org_size = pFontDict->GetIntegerFor("Length1") +
                      pFontDict->GetIntegerFor("Length2") +
                      pFontDict->GetIntegerFor("Length3");
   org_size = std::max(org_size, 0);
 
-  CPDF_StreamAcc* pFontFile = new CPDF_StreamAcc;
-  pFontFile->LoadAllData(pFontStream, false, org_size);
+  auto pFontAcc = pdfium::MakeUnique<CPDF_StreamAcc>();
+  pFontAcc->LoadAllData(pFontStream, false, org_size);
 
-  CPDF_CountedStreamAcc* pCountedFont = new CPDF_CountedStreamAcc(pFontFile);
+  CPDF_CountedStreamAcc* pCountedFont =
+      new CPDF_CountedStreamAcc(std::move(pFontAcc));
   m_FontFileMap[pFontStream] = pCountedFont;
   return pCountedFont->AddRef();
 }
 
 void CPDF_DocPageData::ReleaseFontFileStreamAcc(
     const CPDF_Stream* pFontStream) {
   if (!pFontStream)
     return;
 
   auto it = m_FontFileMap.find(pFontStream);
@@ skipping 24 matching lines @@
 }
 
 CPDF_CountedPattern* CPDF_DocPageData::FindPatternPtr(
     CPDF_Object* pPatternObj) const {
   if (!pPatternObj)
     return nullptr;
 
   auto it = m_PatternMap.find(pPatternObj);
   return it != m_PatternMap.end() ? it->second : nullptr;
 }