Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

core/include/fpdfapi/fpdf_pageobj.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FPDF_PAGEOBJ_H_
 #define _FPDF_PAGEOBJ_H_
 #ifndef _FPDF_RESOURCE_
 #include "fpdf_resource.h"
@@ skipping 202 matching lines @@
 public:
 
     CPDF_TextStateData();
 
     CPDF_TextStateData(const CPDF_TextStateData& src);
 
     ~CPDF_TextStateData();
 
     CPDF_Font*                  m_pFont;
 
+    CPDF_Document*              m_pDocument;

[Tom Sepez, 2014/08/18 18:19:31]

Are we sure that this object doesn't ever out-live the CPDF_Document, in which
case we wind up with a stale pointer here?

[jun_fang, 2014/08/18 20:33:54]

Sorry. Can you explain your question more? I don't think that I understand it. 

+
     FX_FLOAT                    m_FontSize;
 
     FX_FLOAT                    m_CharSpace;
 
     FX_FLOAT                    m_WordSpace;
 
     FX_FLOAT            m_Matrix[4];
 
     int                                 m_TextMode;
 
@@ skipping 479 matching lines @@
     CFX_DIBitmap*               m_pBitmap;
 
     CFX_ArrayTemplate<CFX_AffineMatrix> m_Matrices;
 
     void                                AddMatrix(CFX_AffineMatrix& matrix);
 protected:
     virtual void                Transform(const CFX_AffineMatrix& matrix) {}
     virtual void                CopyData(const CPDF_PageObject* pSrcObjet) {}
 };
 #endif