Fix use-after-free in CPDF_Color::~CPDF_Color

core/include/fpdfapi/fpdf_resource.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FPDF_RESOURCE_
 #define _FPDF_RESOURCE_
 #ifndef _FPDF_PARSER_
 #include "fpdf_parser.h"
@@ skipping 712 matching lines @@
     FX_FLOAT*                   m_pBuffer;
 protected:
     void        ReleaseBuffer();
     void        ReleaseColorSpace();
 };
 #define PATTERN_TILING          1
 #define PATTERN_SHADING         2
 class CPDF_Pattern : public CFX_Object
 {
 public:
 

[Tom Sepez, 2014/08/04 18:02:32]

Too bad this doesn't have a constructor to set up the pointer members in all
cases.

[palmer, 2014/08/04 18:17:11]

We need to start making sure every class and struct has the constructors it
needs, and that all constructors assert at least minimal correctness and safety
invariants. Now is a good time to start. :)

[jun_fang, 2014/08/04 18:37:11]

This class is a interface class. It doesn't need to be instantiated.So it just
have a protected constructor CPDF_Pattern(const CFX_AffineMatrix*
pParentMatrix). I will add the member variables initialization in this
constructor. 

-    virtual ~CPDF_Pattern() {}
+    virtual ~CPDF_Pattern();
+    void SaveColor(CPDF_Color* pColor) {m_pColor = pColor;}
 
-    CPDF_Object*                        m_pPatternObj;
+    CPDF_Object*                m_pPatternObj;
 
-    int                                         m_PatternType;
+    int                         m_PatternType;
 
-    CFX_AffineMatrix            m_Pattern2Form;
-    CFX_AffineMatrix            m_ParentMatrix;
+    CFX_AffineMatrix            m_Pattern2Form;
+    CFX_AffineMatrix            m_ParentMatrix;
 
-    CPDF_Document*                      m_pDocument;
+    CPDF_Document*              m_pDocument;
+    CPDF_Color*                 m_pColor;
 
 protected:
 
     CPDF_Pattern(const CFX_AffineMatrix* pParentMatrix)
     {
         if (pParentMatrix) {
             m_ParentMatrix = *pParentMatrix;
         }
     }
 };
@@ skipping 197 matching lines @@
     FX_BOOL                                     m_bIsMask;
 
     FX_BOOL                                     m_bInterpolate;
 
     CPDF_Document*                      m_pDocument;
 
     CPDF_Dictionary*            m_pOC;
     CPDF_Dictionary*    InitJPEG(FX_LPBYTE pData, FX_DWORD size);
 };
 #endif