Fix use-after-free in CPDF_Color::~CPDF_Color

core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "pageint.h"
+
+CPDF_Pattern::CPDF_Pattern(const CFX_AffineMatrix* pParentMatrix) :
+    m_pPatternObj(NULL), m_PatternType(PATTERN_TILING), m_pDocument(NULL), m_pColor(NULL)
+{
+    if (pParentMatrix) {
+        m_ParentMatrix = *pParentMatrix;
+    }
+}
+
+CPDF_Pattern::~CPDF_Pattern()
+{
+    if (m_pColor) {
+        m_pColor->SetValue(NULL, NULL, 0);
+        m_pColor = NULL;
+    }
+}
 CPDF_TilingPattern::CPDF_TilingPattern(CPDF_Document* pDoc, CPDF_Object* pPatternObj, const CFX_AffineMatrix* parentMatrix) :
     CPDF_Pattern(parentMatrix)
 {
     m_PatternType = PATTERN_TILING;
     m_pPatternObj = pPatternObj;
     m_pDocument = pDoc;
     CPDF_Dictionary* pDict = m_pPatternObj->GetDict();
     ASSERT(pDict != NULL);
     m_Pattern2Form = pDict->GetMatrix(FX_BSTRC("Matrix"));
     m_bColored = pDict->GetInteger(FX_BSTRC("PaintType")) == 1;
     if (parentMatrix) {
         m_Pattern2Form.Concat(*parentMatrix);
     }
     m_pForm = NULL;
 }
 CPDF_TilingPattern::~CPDF_TilingPattern()
 {
     if (m_pForm) {
         delete m_pForm;
+        m_pForm = NULL;
     }
 }
 FX_BOOL CPDF_TilingPattern::Load()
 {
     if (m_pForm != NULL) {
         return TRUE;
     }
     CPDF_Dictionary* pDict = m_pPatternObj->GetDict();
     if (pDict == NULL) {
         return FALSE;
@@ skipping 231 matching lines @@
             }
         }
         stream.m_BitStream.SkipBits(stream.m_nComps * stream.m_nCompBits * color_count);
         if (bGouraud) {
             stream.m_BitStream.ByteAlign();
         }
     }
     rect.Transform(pMatrix);
     return rect;
 }