Fix the problem that memory is accessed after released due to invalid type-cast

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 1108 matching lines @@
         pID = ParseIndirectObject(NULL, ((CPDF_Reference*)pID)->GetRefObjNum());
         m_pTrailer->SetAt(FX_BSTRC("ID"), pID);
     }
     if (pID == NULL || pID->GetType() != PDFOBJ_ARRAY) {
         return NULL;
     }
     return (CPDF_Array*)pID;
 }
 FX_DWORD CPDF_Parser::GetRootObjNum()
 {
-    CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL;
+    CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Root")) : NULL;
     if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) {
         return 0;
     }
-    return pRef->GetRefObjNum();
+    return ((CPDF_Reference*) pRef)->GetRefObjNum();
 }
 FX_DWORD CPDF_Parser::GetInfoObjNum()
 {
-    CPDF_Reference* pRef = m_pTrailer ? (CPDF_Reference*)m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL;
+    CPDF_Object* pRef = m_pTrailer ? m_pTrailer->GetElement(FX_BSTRC("Info")) : NULL;
     if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) {
         return 0;
     }
-    return pRef->GetRefObjNum();
+    return ((CPDF_Reference*) pRef)->GetRefObjNum();
 }
 FX_BOOL CPDF_Parser::IsFormStream(FX_DWORD objnum, FX_BOOL& bForm)
 {
     bForm = FALSE;
     if (objnum >= (FX_DWORD)m_CrossRef.GetSize()) {
         return TRUE;
     }
     if (m_V5Type[objnum] == 0) {
         return TRUE;
     }
@@ skipping 433 matching lines @@
         RootObjNum = GetRootObjNum();
         if (RootObjNum == 0) {
             return PDFPARSE_ERROR_FORMAT;
         }
         dwRet = SetEncryptHandler();
         if (dwRet != PDFPARSE_ERROR_SUCCESS) {
             return dwRet;
         }
     }
     if (m_pSecurityHandler && m_pSecurityHandler->IsMetadataEncrypted()) {
-        CPDF_Reference* pMetadata = (CPDF_Reference*)m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata"));
+        CPDF_Object* pMetadata = m_pDocument->GetRoot()->GetElement(FX_BSTRC("Metadata"));
         if (pMetadata && pMetadata->GetType() == PDFOBJ_REFERENCE) {
-            m_Syntax.m_MetadataObjnum = pMetadata->GetRefObjNum();
-        }
+            m_Syntax.m_MetadataObjnum = ((CPDF_Reference*) pMetadata)->GetRefObjNum();
+        }         

[palmer, 2014/08/06 20:23:04]

Remove this trailing whitespace.

[jun_fang, 2014/08/06 21:06:49]

OK.

     }
     return PDFPARSE_ERROR_SUCCESS;
 }
 FX_BOOL CPDF_Parser::LoadLinearizedAllCrossRefV5(FX_FILESIZE xrefpos)
 {
     if (!LoadCrossRefV5(xrefpos, xrefpos, FALSE)) {
         return FALSE;
     }
     while (xrefpos)
         if (!LoadCrossRefV5(xrefpos, xrefpos, FALSE)) {
@@ skipping 1706 matching lines @@
     }
     switch (pKids->GetType()) {
         case PDFOBJ_REFERENCE: {
                 CPDF_Reference *pKid = (CPDF_Reference *)pKids;
                 m_PageObjList.Add(pKid->GetRefObjNum());
             }
             break;
         case PDFOBJ_ARRAY: {
                 CPDF_Array *pKidsArray = (CPDF_Array *)pKids;
                 for (FX_DWORD i = 0; i < pKidsArray->GetCount(); ++i) {
-                    CPDF_Reference *pKid = (CPDF_Reference *)pKidsArray->GetElement(i);
-                    m_PageObjList.Add(pKid->GetRefObjNum());
+                    CPDF_Object *pKid = (CPDF_Object *)pKidsArray->GetElement(i);
+                    if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) {
+                        m_PageObjList.Add(((CPDF_Reference *)pKid)->GetRefObjNum());
+                    }
                 }
             }
             break;
         default:
             m_docStatus = PDF_DATAAVAIL_ERROR;
             return FALSE;
     }
     return TRUE;
 }
 FX_BOOL CPDF_DataAvail::CheckPages(IFX_DownloadHints* pHints)
@@ skipping 1069 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }