Ensure CPDF_CountedObjects only made from owned references.

core/fpdfapi/render/cpdf_docrenderdata.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/render/cpdf_docrenderdata.h"
 
 #include <memory>
 
@@ skipping 37 matching lines @@
       delete value;
       m_TransferFuncMap.erase(curr_it);
     }
   }
 }
 
 CPDF_Type3Cache* CPDF_DocRenderData::GetCachedType3(CPDF_Type3Font* pFont) {
   CPDF_CountedObject<CPDF_Type3Cache>* pCache;
   auto it = m_Type3FaceMap.find(pFont);
   if (it == m_Type3FaceMap.end()) {
-    CPDF_Type3Cache* pType3 = new CPDF_Type3Cache(pFont);
-    pCache = new CPDF_CountedObject<CPDF_Type3Cache>(pType3);
+    pCache = new CPDF_CountedObject<CPDF_Type3Cache>(
+        pdfium::MakeUnique<CPDF_Type3Cache>(pFont));
     m_Type3FaceMap[pFont] = pCache;
   } else {
     pCache = it->second;
   }
   return pCache->AddRef();
 }
 
 void CPDF_DocRenderData::ReleaseCachedType3(CPDF_Type3Font* pFont) {
   auto it = m_Type3FaceMap.find(pFont);
   if (it != m_Type3FaceMap.end()) {
@@ skipping 27 matching lines @@
     for (uint32_t i = 0; i < 3; ++i) {
       pFuncs[2 - i] = CPDF_Function::Load(pArray->GetDirectObjectAt(i));
       if (!pFuncs[2 - i])
         return nullptr;
     }
   } else {
     pFuncs[0] = CPDF_Function::Load(pObj);
     if (!pFuncs[0])
       return nullptr;
   }
-  CPDF_TransferFunc* pTransfer = new CPDF_TransferFunc(m_pPDFDoc);
   CPDF_CountedObject<CPDF_TransferFunc>* pTransferCounter =
-      new CPDF_CountedObject<CPDF_TransferFunc>(pTransfer);
+      new CPDF_CountedObject<CPDF_TransferFunc>(
+          pdfium::MakeUnique<CPDF_TransferFunc>(m_pPDFDoc));
+  CPDF_TransferFunc* pTransfer = pTransferCounter->get();
   m_TransferFuncMap[pObj] = pTransferCounter;
   FX_FLOAT output[kMaxOutputs];
   FXSYS_memset(output, 0, sizeof(output));
   FX_FLOAT input;
   int noutput;
   for (int v = 0; v < 256; ++v) {
     input = (FX_FLOAT)v / 255.0f;
     if (bUniTransfer) {
       if (pFuncs[0] && pFuncs[0]->CountOutputs() <= kMaxOutputs)
         pFuncs[0]->Call(&input, 1, output, noutput);
@@ skipping 25 matching lines @@
   auto it = m_TransferFuncMap.find(pObj);
   if (it != m_TransferFuncMap.end()) {
     it->second->RemoveRef();
     if (it->second->use_count() < 2) {
       delete it->second->get();
       delete it->second;
       m_TransferFuncMap.erase(it);
     }
   }
 }