Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fdrm/fx_crypt.h"
 #include "../fpdf_font/font_int.h"
@@ skipping 110 matching lines @@
 }
 void CPDF_Document::RemoveColorSpaceFromPageData(CPDF_Object* pCSObj)
 {
     if (!pCSObj) {
         return;
     }
     GetPageData()->ReleaseColorSpace(pCSObj);
 }
 CPDF_DocPageData::CPDF_DocPageData(CPDF_Document *pPDFDoc)
     : m_pPDFDoc(pPDFDoc)
+    , m_bForceClear(FALSE)

[Tom Sepez, 2014/08/18 22:16:01]

this should move down til after the m_FontFileMap initializer, so that these get
initialized in the same order they're declared in the .h file.

[jun_fang, 2014/08/18 22:59:31]

Acknowledge.

     , m_FontMap()
     , m_ColorSpaceMap()
     , m_PatternMap()
     , m_ImageMap()
     , m_IccProfileMap()
     , m_FontFileMap()
 {
     m_FontMap.InitHashTable(64);
     m_ColorSpaceMap.InitHashTable(32);
     m_PatternMap.InitHashTable(16);
     m_ImageMap.InitHashTable(64);
     m_IccProfileMap.InitHashTable(16);
     m_FontFileMap.InitHashTable(32);
 }
 CPDF_DocPageData::~CPDF_DocPageData()
 {
     Clear(FALSE);
+    m_bForceClear = TRUE;

[Tom Sepez, 2014/08/18 22:09:22]

Let's move this down to Clear() itself. The first line of Clear() could be:

  if (bRelease)
      m_bForceClear = TRUE;

that way, should this get called elsewhere someday, its still ok.

[jun_fang, 2014/08/18 22:59:31]

Good.

     Clear(TRUE);
 }
 void CPDF_DocPageData::Clear(FX_BOOL bRelease)
 {
     FX_POSITION pos;
     FX_DWORD    nCount;
     {

[Tom Sepez, 2014/08/18 22:09:22]

nit:  these braces don't do anything and can be removed (several places) while
we're modifying Clear().

         pos = m_PatternMap.GetStartPosition();
         while (pos) {
             CPDF_Object* ptObj;
             CPDF_CountedObject<CPDF_Pattern*>* ptData;
             m_PatternMap.GetNextAssoc(pos, ptObj, ptData);
             nCount = ptData->m_nCount;
             if (bRelease || nCount < 2) {
                 delete ptData->m_Obj;
                 ptData->m_Obj = NULL;
             }
@@ skipping 472 matching lines @@
     m_FontFileMap.SetAt(pFontStream, ftData);
     return pFontFile;
 }
 void CPDF_DocPageData::ReleaseFontFileStreamAcc(CPDF_Stream* pFontStream, FX_BOOL bForce)
 {
     if (!pFontStream) {
         return;
     }
     PDF_DocPageData_Release<CPDF_Stream*, CPDF_StreamAcc*>(m_FontFileMap, pFontStream, NULL, bForce);
 }