Fix use-after-free in CPDF_Color::~CPDF_Color

core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "pageint.h"
+
+CPDF_Pattern::~CPDF_Pattern()
+{
+    if (m_pColor) {
+        m_pColor->SetValue(NULL, NULL, 0);
+    }
+    m_pColor = NULL;

[Tom Sepez, 2014/08/04 18:02:32]

This can move inside the if {} since its already NULL if the if-branch isn't
taken.

[palmer, 2014/08/04 18:17:11]

Alternately, save a level of indentation:

if (!m_pColor)
    return;

m_pColor->SetValue(NULL, NULL, 0);
m_pColor = NULL;

[jun_fang, 2014/08/04 18:37:11]

Acknowledge

+}
 CPDF_TilingPattern::CPDF_TilingPattern(CPDF_Document* pDoc, CPDF_Object* pPatternObj, const CFX_AffineMatrix* parentMatrix) :
     CPDF_Pattern(parentMatrix)
 {
     m_PatternType = PATTERN_TILING;
     m_pPatternObj = pPatternObj;
     m_pDocument = pDoc;
+    m_pColor = NULL;
     CPDF_Dictionary* pDict = m_pPatternObj->GetDict();
     ASSERT(pDict != NULL);
     m_Pattern2Form = pDict->GetMatrix(FX_BSTRC("Matrix"));
     m_bColored = pDict->GetInteger(FX_BSTRC("PaintType")) == 1;
     if (parentMatrix) {
         m_Pattern2Form.Concat(*parentMatrix);
     }
     m_pForm = NULL;
 }
 CPDF_TilingPattern::~CPDF_TilingPattern()
 {
     if (m_pForm) {
         delete m_pForm;
+        m_pForm = NULL;
     }
 }
 FX_BOOL CPDF_TilingPattern::Load()
 {
     if (m_pForm != NULL) {
         return TRUE;
     }
     CPDF_Dictionary* pDict = m_pPatternObj->GetDict();
     if (pDict == NULL) {
         return FALSE;
     }
     m_bColored = pDict->GetInteger(FX_BSTRC("PaintType")) == 1;
     m_XStep = (FX_FLOAT)FXSYS_fabs(pDict->GetNumber(FX_BSTRC("XStep")));
     m_YStep = (FX_FLOAT)FXSYS_fabs(pDict->GetNumber(FX_BSTRC("YStep")));
     if (m_pPatternObj->GetType() != PDFOBJ_STREAM) {
         return FALSE;
     }
     CPDF_Stream* pStream = (CPDF_Stream*)m_pPatternObj;
     m_pForm = FX_NEW CPDF_Form(m_pDocument, NULL, pStream);
     m_pForm->ParseContent(NULL, &m_ParentMatrix, NULL, NULL);
     m_BBox = pDict->GetRect(FX_BSTRC("BBox"));
     return TRUE;
 }
 CPDF_ShadingPattern::CPDF_ShadingPattern(CPDF_Document* pDoc, CPDF_Object* pPatternObj, FX_BOOL bShading, const CFX_AffineMatrix* parentMatrix) : CPDF_Pattern(parentMatrix)
 {
     m_PatternType = PATTERN_SHADING;
     m_pPatternObj = bShading ? NULL : pPatternObj;
     m_pDocument = pDoc;
+    m_pColor = NULL;
     m_bShadingObj = bShading;
     if (!bShading) {
         CPDF_Dictionary* pDict = m_pPatternObj->GetDict();
         ASSERT(pDict != NULL);
         m_Pattern2Form = pDict->GetMatrix(FX_BSTRC("Matrix"));
         m_pShadingObj = pDict->GetElementValue(FX_BSTRC("Shading"));
         if (parentMatrix) {
             m_Pattern2Form.Concat(*parentMatrix);
         }
     } else {
@@ skipping 203 matching lines @@
             }
         }
         stream.m_BitStream.SkipBits(stream.m_nComps * stream.m_nCompBits * color_count);
         if (bGouraud) {
             stream.m_BitStream.ByteAlign();
         }
     }
     rect.Transform(pMatrix);
     return rect;
 }