Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

core/src/fpdfapi/fpdf_page/pageint.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_pageobj.h"
 #define PARSE_STEP_LIMIT                100
 #define STREAM_PARSE_BUFSIZE    20480
 class CPDF_QuickFontCache;
@@ skipping 394 matching lines @@
         map.RemoveKey(findKey);
         return TRUE;
     }
     return FALSE;
 }
 class CPDF_DocPageData : public CFX_Object
 {
 public:
     CPDF_DocPageData(CPDF_Document *pPDFDoc);
     ~CPDF_DocPageData();
-    void                                        Clear(FX_BOOL bRelease = FALSE);
-    CPDF_Font*                          GetFont(CPDF_Dictionary* pFontDict, FX_BOOL findOnly);
-    CPDF_Font*                          GetStandardFont(FX_BSTR fontName, CPDF_FontEncoding* pEncoding);
-    void                                        ReleaseFont(CPDF_Dictionary* pFontDict);
-    CPDF_ColorSpace*            GetColorSpace(CPDF_Object* pCSObj, CPDF_Dictionary* pResources);
-    CPDF_ColorSpace*            GetCopiedColorSpace(CPDF_Object* pCSObj);
-    void                                        ReleaseColorSpace(CPDF_Object* pColorSpace);
-    CPDF_Pattern*                       GetPattern(CPDF_Object* pPatternObj, FX_BOOL bShading, const CFX_AffineMatrix* matrix);
-    void                                        ReleasePattern(CPDF_Object* pPatternObj);
-    CPDF_Image*                         GetImage(CPDF_Object* pImageStream);
-    void                                        ReleaseImage(CPDF_Object* pImageStream);
-    CPDF_IccProfile*            GetIccProfile(CPDF_Stream* pIccProfileStream, FX_INT32 nComponents);
-    void                                        ReleaseIccProfile(CPDF_Stream* pIccProfileStream, CPDF_IccProfile* pIccProfile);
-    CPDF_StreamAcc*                     GetFontFileStreamAcc(CPDF_Stream* pFontStream);
-    void                                        ReleaseFontFileStreamAcc(CPDF_Stream* pFontStream, FX_BOOL bForce = FALSE);
-    CPDF_Document*                      m_pPDFDoc;
-    CPDF_FontMap                        m_FontMap;
-    CPDF_ColorSpaceMap          m_ColorSpaceMap;
-    CPDF_PatternMap                     m_PatternMap;
-    CPDF_ImageMap                       m_ImageMap;
-    CPDF_IccProfileMap          m_IccProfileMap;
-    CFX_MapByteStringToPtr      m_HashProfileMap;
-    CPDF_FontFileMap            m_FontFileMap;
+    void                        Clear(FX_BOOL bRelease = FALSE);
+    CPDF_Font*                  GetFont(CPDF_Dictionary* pFontDict, FX_BOOL findOnly);
+    CPDF_Font*                  GetStandardFont(FX_BSTR fontName, CPDF_FontEncoding* pEncoding);
+    void                        ReleaseFont(CPDF_Dictionary* pFontDict);
+    CPDF_ColorSpace*            GetColorSpace(CPDF_Object* pCSObj, CPDF_Dictionary* pResources);
+    CPDF_ColorSpace*            GetCopiedColorSpace(CPDF_Object* pCSObj);
+    void                        ReleaseColorSpace(CPDF_Object* pColorSpace);
+    CPDF_Pattern*               GetPattern(CPDF_Object* pPatternObj, FX_BOOL bShading, const CFX_AffineMatrix* matrix);
+    void                        ReleasePattern(CPDF_Object* pPatternObj);
+    CPDF_Image*                 GetImage(CPDF_Object* pImageStream);
+    void                        ReleaseImage(CPDF_Object* pImageStream);
+    CPDF_IccProfile*            GetIccProfile(CPDF_Stream* pIccProfileStream, FX_INT32 nComponents);
+    void                        ReleaseIccProfile(CPDF_Stream* pIccProfileStream, CPDF_IccProfile* pIccProfile);
+    CPDF_StreamAcc*             GetFontFileStreamAcc(CPDF_Stream* pFontStream);
+    void                        ReleaseFontFileStreamAcc(CPDF_Stream* pFontStream, FX_BOOL bForce = FALSE);
+    FX_BOOL                     IsForceClear() const {return m_bForceClear;}
+

[Tom Sepez, 2014/08/18 22:38:58]

nit: the m_ members should be protected: given the accessors above.  I quick
check shows this compiles with this change on my box.

+    CPDF_Document*              m_pPDFDoc;
+    CPDF_FontMap                m_FontMap;
+    CPDF_ColorSpaceMap          m_ColorSpaceMap;
+    CPDF_PatternMap             m_PatternMap;
+    CPDF_ImageMap               m_ImageMap;
+    CPDF_IccProfileMap          m_IccProfileMap;
+    CFX_MapByteStringToPtr      m_HashProfileMap;
+    CPDF_FontFileMap            m_FontFileMap;
+    FX_BOOL                     m_bForceClear;
 };
 class CPDF_Function : public CFX_Object
 {
 public:
     static CPDF_Function*       Load(CPDF_Object* pFuncObj);
     virtual ~CPDF_Function();
     FX_BOOL             Call(FX_FLOAT* inputs, int ninputs, FX_FLOAT* results, int& nresults) const;
     int                 CountInputs()
     {
         return m_nInputs;
@@ skipping 48 matching lines @@
 public:
     struct _NamingState : public CFX_Object {
         CFX_ByteString  m_Prefix;
         int                             m_nIndex;
     };
     ~CPDF_ResourceNaming();
     CFX_ByteString              GetName(const CPDF_Dictionary* pResList, FX_LPCSTR szType);
 protected:
     CFX_MapByteStringToPtr      m_NamingCache;
 };