Avoid leaks in pdfium_fuzzer by using unique_ptr<>

pdf/pdfium/fuzzers/pdfium_fuzzer.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This fuzzer is simplified & cleaned up pdfium/samples/pdfium_test.cc
 
 #include <assert.h>
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 #ifdef _MSC_VER
 #include <Windows.h>
 #else
 #include <unistd.h>
 #endif
 
 #include <list>
+#include <memory>
 #include <sstream>
 #include <string>
 #include <utility>
 #include <vector>
 
+#include "third_party/pdfium/public/cpp/fpdf_deleters.h"
 #include "third_party/pdfium/public/fpdf_dataavail.h"
 #include "third_party/pdfium/public/fpdf_ext.h"
 #include "third_party/pdfium/public/fpdf_formfill.h"
 #include "third_party/pdfium/public/fpdf_text.h"
 #include "third_party/pdfium/public/fpdfview.h"
 #include "third_party/pdfium/testing/test_support.h"
 
 #include "v8/include/v8.h"
 
 static int ExampleAppAlert(IPDF_JSPLATFORM*,
@@ skipping 10 matching lines @@
 
 FPDF_BOOL Is_Data_Avail(FX_FILEAVAIL* pThis, size_t offset, size_t size) {
   return true;
 }
 
 static void Add_Segment(FX_DOWNLOADHINTS* pThis, size_t offset, size_t size) {}
 
 static bool RenderPage(const FPDF_DOCUMENT& doc,
                        const FPDF_FORMHANDLE& form,
                        const int page_index) {
-  FPDF_PAGE page = FPDF_LoadPage(doc, page_index);
+  std::unique_ptr<void, FPDFPageDeleter> page(FPDF_LoadPage(doc, page_index));
   if (!page)
     return false;
 
-  FPDF_TEXTPAGE text_page = FPDFText_LoadPage(page);
-  FORM_OnAfterLoadPage(page, form);
-  FORM_DoPageAAction(page, form, FPDFPAGE_AACTION_OPEN);
+  std::unique_ptr<void, FPDFTextPageDeleter> text_page(
+      FPDFText_LoadPage(page.get()));
+  FORM_OnAfterLoadPage(page.get(), form);
+  FORM_DoPageAAction(page.get(), form, FPDFPAGE_AACTION_OPEN);
 
   const double scale = 1.0;
-  int width = static_cast<int>(FPDF_GetPageWidth(page) * scale);
-  int height = static_cast<int>(FPDF_GetPageHeight(page) * scale);
-
-  FPDF_BITMAP bitmap = FPDFBitmap_Create(width, height, 0);
+  int width = static_cast<int>(FPDF_GetPageWidth(page.get()) * scale);
+  int height = static_cast<int>(FPDF_GetPageHeight(page.get()) * scale);
+  std::unique_ptr<void, FPDFBitmapDeleter> bitmap(
+      FPDFBitmap_Create(width, height, 0));
   if (bitmap) {
-    FPDFBitmap_FillRect(bitmap, 0, 0, width, height, 0xFFFFFFFF);
-    FPDF_RenderPageBitmap(bitmap, page, 0, 0, width, height, 0, 0);
-
-    FPDF_FFLDraw(form, bitmap, page, 0, 0, width, height, 0, 0);
-
-    FPDFBitmap_Destroy(bitmap);
+    FPDFBitmap_FillRect(bitmap.get(), 0, 0, width, height, 0xFFFFFFFF);
+    FPDF_RenderPageBitmap(bitmap.get(), page.get(), 0, 0, width, height, 0, 0);
+    FPDF_FFLDraw(form, bitmap.get(), page.get(), 0, 0, width, height, 0, 0);
   }
-  FORM_DoPageAAction(page, form, FPDFPAGE_AACTION_CLOSE);
-  FORM_OnBeforeClosePage(page, form);
-  FPDFText_ClosePage(text_page);
-  FPDF_ClosePage(page);
+  FORM_DoPageAAction(page.get(), form, FPDFPAGE_AACTION_CLOSE);
+  FORM_OnBeforeClosePage(page.get(), form);
   return !!bitmap;
 }
 
 static void RenderPdf(const char* pBuf, size_t len) {
   IPDF_JSPLATFORM platform_callbacks;
   memset(&platform_callbacks, '\0', sizeof(platform_callbacks));
   platform_callbacks.version = 3;
   platform_callbacks.app_alert = ExampleAppAlert;
   platform_callbacks.Doc_gotoPage = ExampleDocGotoPage;
 
@@ skipping 12 matching lines @@
   FX_FILEAVAIL file_avail;
   memset(&file_avail, '\0', sizeof(file_avail));
   file_avail.version = 1;
   file_avail.IsDataAvail = Is_Data_Avail;
 
   FX_DOWNLOADHINTS hints;
   memset(&hints, '\0', sizeof(hints));
   hints.version = 1;
   hints.AddSegment = Add_Segment;
 
-  FPDF_DOCUMENT doc;
+  std::unique_ptr<void, FPDFDocumentDeleter> doc;

[Lei Zhang, 2017/03/17 18:42:09]

Move this below |pdf_avail| so we preserve the same destruction order as before?

[Tom Sepez, 2017/03/17 18:47:06]

Done.

   int nRet = PDF_DATA_NOTAVAIL;
   bool bIsLinearized = false;
-  FPDF_AVAIL pdf_avail = FPDFAvail_Create(&file_avail, &file_access);
+  std::unique_ptr<void, FPDFAvailDeleter> pdf_avail(
+      FPDFAvail_Create(&file_avail, &file_access));
 
-  if (FPDFAvail_IsLinearized(pdf_avail) == PDF_LINEARIZED) {
-    doc = FPDFAvail_GetDocument(pdf_avail, nullptr);
+  if (FPDFAvail_IsLinearized(pdf_avail.get()) == PDF_LINEARIZED) {
+    doc.reset(FPDFAvail_GetDocument(pdf_avail.get(), nullptr));
     if (doc) {
-      while (nRet == PDF_DATA_NOTAVAIL) {
-        nRet = FPDFAvail_IsDocAvail(pdf_avail, &hints);
-      }
-      if (nRet == PDF_DATA_ERROR) {
+      while (nRet == PDF_DATA_NOTAVAIL)
+        nRet = FPDFAvail_IsDocAvail(pdf_avail.get(), &hints);
+
+      if (nRet == PDF_DATA_ERROR)
         return;
-      }
-      nRet = FPDFAvail_IsFormAvail(pdf_avail, &hints);
-      if (nRet == PDF_FORM_ERROR || nRet == PDF_FORM_NOTAVAIL) {
+
+      nRet = FPDFAvail_IsFormAvail(pdf_avail.get(), &hints);
+      if (nRet == PDF_FORM_ERROR || nRet == PDF_FORM_NOTAVAIL)
         return;
-      }
+
       bIsLinearized = true;
     }
   } else {
-    doc = FPDF_LoadCustomDocument(&file_access, nullptr);
+    doc.reset(FPDF_LoadCustomDocument(&file_access, nullptr));
   }
 
-  if (!doc) {
-    FPDFAvail_Destroy(pdf_avail);
+  if (!doc)
     return;
-  }
 
-  (void)FPDF_GetDocPermissions(doc);
+  (void)FPDF_GetDocPermissions(doc.get());
 
-  FPDF_FORMHANDLE form = FPDFDOC_InitFormFillEnvironment(doc, &form_callbacks);
-  FPDF_SetFormFieldHighlightColor(form, 0, 0xFFE4DD);
-  FPDF_SetFormFieldHighlightAlpha(form, 100);
+  std::unique_ptr<void, FPDFFormHandleDeleter> form(
+      FPDFDOC_InitFormFillEnvironment(doc.get(), &form_callbacks));
+  FPDF_SetFormFieldHighlightColor(form.get(), 0, 0xFFE4DD);
+  FPDF_SetFormFieldHighlightAlpha(form.get(), 100);
+  FORM_DoDocumentJSAction(form.get());
+  FORM_DoDocumentOpenAction(form.get());
 
-  FORM_DoDocumentJSAction(form);
-  FORM_DoDocumentOpenAction(form);
-
-  int page_count = FPDF_GetPageCount(doc);
-
+  int page_count = FPDF_GetPageCount(doc.get());
   for (int i = 0; i < page_count; ++i) {
     if (bIsLinearized) {
       nRet = PDF_DATA_NOTAVAIL;
-      while (nRet == PDF_DATA_NOTAVAIL) {
-        nRet = FPDFAvail_IsPageAvail(pdf_avail, i, &hints);
-      }
-      if (nRet == PDF_DATA_ERROR) {
+      while (nRet == PDF_DATA_NOTAVAIL)
+        nRet = FPDFAvail_IsPageAvail(pdf_avail.get(), i, &hints);
+
+      if (nRet == PDF_DATA_ERROR)
         return;
-      }
     }
-    RenderPage(doc, form, i);
+    RenderPage(doc.get(), form.get(), i);
   }
-
-  FORM_DoDocumentAAction(form, FPDFDOC_AACTION_WC);
-  FPDFDOC_ExitFormFillEnvironment(form);
-  FPDF_CloseDocument(doc);
-  FPDFAvail_Destroy(pdf_avail);
+  FORM_DoDocumentAAction(form.get(), FPDFDOC_AACTION_WC);
 }
 
 std::string ProgramPath() {
 #ifdef _MSC_VER
   wchar_t wpath[MAX_PATH];
   char path[MAX_PATH];
   DWORD res = GetModuleFileName(NULL, wpath, MAX_PATH);
   assert(res != 0);
   wcstombs(path, wpath, MAX_PATH);
   return std::string(path, res);
@@ skipping 32 matching lines @@
   FPDF_LIBRARY_CONFIG config;
   UNSUPPORT_INFO unsupport_info;
 };
 
 static TestCase* testCase = new TestCase();
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   RenderPdf(reinterpret_cast<const char*>(data), size);
   return 0;
 }