Fix use-after-free in CPDF_Color::~CPDF_Color

core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "pageint.h"
@@ skipping 1251 matching lines @@
 }
 void CPDF_Color::ReleaseBuffer()
 {
     if (!m_pBuffer) {
         return;
     }
     if (m_pCS->GetFamily() == PDFCS_PATTERN) {
         PatternValue* pvalue = (PatternValue*)m_pBuffer;
         CPDF_Pattern* pPattern = pvalue->m_pPattern;
         if (pPattern && pPattern->m_pDocument) {
+            pPattern->SaveColor(NULL);
             pPattern->m_pDocument->GetPageData()->ReleasePattern(pPattern->m_pPatternObj);
         }
     }
     FX_Free(m_pBuffer);
     m_pBuffer = NULL;
 }
 void CPDF_Color::ReleaseColorSpace()
 {
     if (m_pCS && m_pCS->m_pDocument && m_pCS->GetArray()) {
         m_pCS->m_pDocument->GetPageData()->ReleaseColorSpace(m_pCS->GetArray());
@@ skipping 40 matching lines @@
         m_pBuffer = m_pCS->CreateBuf();
     }
     CPDF_DocPageData* pDocPageData = NULL;
     PatternValue* pvalue = (PatternValue*)m_pBuffer;
     if (pvalue->m_pPattern && pvalue->m_pPattern->m_pDocument) {
         pDocPageData = pvalue->m_pPattern->m_pDocument->GetPageData();
         pDocPageData->ReleasePattern(pvalue->m_pPattern->m_pPatternObj);
     }
     pvalue->m_nComps = ncomps;
     pvalue->m_pPattern = pPattern;
+    if (pPattern) {
+        pPattern->SaveColor(this);
+    }
     if (ncomps) {
         FXSYS_memcpy32(pvalue->m_Comps, comps, ncomps * sizeof(FX_FLOAT));
     }
 }
 void CPDF_Color::Copy(const CPDF_Color* pSrc)
 {
     ReleaseBuffer();
     ReleaseColorSpace();
     m_pCS = pSrc->m_pCS;
     if (m_pCS && m_pCS->m_pDocument) {
@@ skipping 51 matching lines @@
     PatternValue* pvalue = (PatternValue*)m_pBuffer;
     return pvalue->m_nComps ? pvalue->m_Comps : NULL;
 }
 FX_BOOL CPDF_Color::IsEqual(const CPDF_Color& other) const
 {
     if (m_pCS != other.m_pCS || m_pCS == NULL) {
         return FALSE;
     }
     return FXSYS_memcmp32(m_pBuffer, other.m_pBuffer, m_pCS->GetBufSize()) == 0;
 }