Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fdrm/fx_crypt.h"
 #include "../fpdf_font/font_int.h"
@@ skipping 116 matching lines @@
     GetPageData()->ReleaseColorSpace(pCSObj);
 }
 CPDF_DocPageData::CPDF_DocPageData(CPDF_Document *pPDFDoc)
     : m_pPDFDoc(pPDFDoc)
     , m_FontMap()
     , m_ColorSpaceMap()
     , m_PatternMap()
     , m_ImageMap()
     , m_IccProfileMap()
     , m_FontFileMap()
+    , m_bForceClear(FALSE)
 {
     m_FontMap.InitHashTable(64);
     m_ColorSpaceMap.InitHashTable(32);
     m_PatternMap.InitHashTable(16);
     m_ImageMap.InitHashTable(64);
     m_IccProfileMap.InitHashTable(16);
     m_FontFileMap.InitHashTable(32);
 }
 CPDF_DocPageData::~CPDF_DocPageData()
 {
     Clear(FALSE);
     Clear(TRUE);
 }
-void CPDF_DocPageData::Clear(FX_BOOL bRelease)
+void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
 {
     FX_POSITION pos;
     FX_DWORD    nCount;
-    {
-        pos = m_PatternMap.GetStartPosition();
-        while (pos) {
-            CPDF_Object* ptObj;
-            CPDF_CountedObject<CPDF_Pattern*>* ptData;
-            m_PatternMap.GetNextAssoc(pos, ptObj, ptData);
-            nCount = ptData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete ptData->m_Obj;
-                ptData->m_Obj = NULL;
-            }
+
+    m_bForceClear = bForceRelease;
+    pos = m_PatternMap.GetStartPosition();
+    while (pos) {
+        CPDF_Object* ptObj;
+        CPDF_CountedObject<CPDF_Pattern*>* ptData;
+        m_PatternMap.GetNextAssoc(pos, ptObj, ptData);
+        nCount = ptData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete ptData->m_Obj;
+            ptData->m_Obj = NULL;
         }
     }
-    {
-        pos = m_FontMap.GetStartPosition();
-        while (pos) {
-            CPDF_Dictionary* fontDict;
-            CPDF_CountedObject<CPDF_Font*>* fontData;
-            m_FontMap.GetNextAssoc(pos, fontDict, fontData);
-            nCount = fontData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete fontData->m_Obj;
-                fontData->m_Obj = NULL;
-            }
+    pos = m_FontMap.GetStartPosition();
+    while (pos) {
+        CPDF_Dictionary* fontDict;
+        CPDF_CountedObject<CPDF_Font*>* fontData;
+        m_FontMap.GetNextAssoc(pos, fontDict, fontData);
+        nCount = fontData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete fontData->m_Obj;
+            fontData->m_Obj = NULL;
         }
     }
-    {
-        pos = m_ImageMap.GetStartPosition();
-        while (pos) {
-            FX_DWORD objNum;
-            CPDF_CountedObject<CPDF_Image*>* imageData;
-            m_ImageMap.GetNextAssoc(pos, objNum, imageData);
-            nCount = imageData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete imageData->m_Obj;
-                delete imageData;
-                m_ImageMap.RemoveKey(objNum);
-            }
+    pos = m_ImageMap.GetStartPosition();
+    while (pos) {
+        FX_DWORD objNum;
+        CPDF_CountedObject<CPDF_Image*>* imageData;
+        m_ImageMap.GetNextAssoc(pos, objNum, imageData);
+        nCount = imageData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete imageData->m_Obj;
+            delete imageData;
+            m_ImageMap.RemoveKey(objNum);
         }
     }
-    {
-        pos = m_ColorSpaceMap.GetStartPosition();
-        while (pos) {
-            CPDF_Object* csKey;
-            CPDF_CountedObject<CPDF_ColorSpace*>* csData;
-            m_ColorSpaceMap.GetNextAssoc(pos, csKey, csData);
-            nCount = csData->m_nCount;
-            if (bRelease || nCount < 2) {
-                csData->m_Obj->ReleaseCS();
-                csData->m_Obj = NULL;
-            }
+    pos = m_ColorSpaceMap.GetStartPosition();
+    while (pos) {
+        CPDF_Object* csKey;
+        CPDF_CountedObject<CPDF_ColorSpace*>* csData;
+        m_ColorSpaceMap.GetNextAssoc(pos, csKey, csData);
+        nCount = csData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            csData->m_Obj->ReleaseCS();
+            csData->m_Obj = NULL;
         }
     }
-    {
-        pos = m_IccProfileMap.GetStartPosition();
-        while (pos) {
-            CPDF_Stream* ipKey;
-            CPDF_CountedObject<CPDF_IccProfile*>* ipData;
-            m_IccProfileMap.GetNextAssoc(pos, ipKey, ipData);
-            nCount = ipData->m_nCount;
-            if (bRelease || nCount < 2) {
-                FX_POSITION pos2 = m_HashProfileMap.GetStartPosition();
-                while (pos2) {
-                    CFX_ByteString bsKey;
-                    CPDF_Stream* pFindStream = NULL;
-                    m_HashProfileMap.GetNextAssoc(pos2, bsKey, (void*&)pFindStream);
-                    if (ipKey == pFindStream) {
-                        m_HashProfileMap.RemoveKey(bsKey);
-                        break;
-                    }
+    pos = m_IccProfileMap.GetStartPosition();
+    while (pos) {
+        CPDF_Stream* ipKey;
+        CPDF_CountedObject<CPDF_IccProfile*>* ipData;
+        m_IccProfileMap.GetNextAssoc(pos, ipKey, ipData);
+        nCount = ipData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            FX_POSITION pos2 = m_HashProfileMap.GetStartPosition();
+            while (pos2) {
+                CFX_ByteString bsKey;
+                CPDF_Stream* pFindStream = NULL;
+                m_HashProfileMap.GetNextAssoc(pos2, bsKey, (void*&)pFindStream);
+                if (ipKey == pFindStream) {
+                    m_HashProfileMap.RemoveKey(bsKey);
+                    break;
                 }
-                delete ipData->m_Obj;
-                delete ipData;
-                m_IccProfileMap.RemoveKey(ipKey);
             }
+            delete ipData->m_Obj;
+            delete ipData;
+            m_IccProfileMap.RemoveKey(ipKey);
         }
     }
-    {
-        pos = m_FontFileMap.GetStartPosition();
-        while (pos) {
-            CPDF_Stream* ftKey;
-            CPDF_CountedObject<CPDF_StreamAcc*>* ftData;
-            m_FontFileMap.GetNextAssoc(pos, ftKey, ftData);
-            nCount = ftData->m_nCount;
-            if (bRelease || nCount < 2) {
-                delete ftData->m_Obj;
-                delete ftData;
-                m_FontFileMap.RemoveKey(ftKey);
-            }
+    pos = m_FontFileMap.GetStartPosition();
+    while (pos) {
+        CPDF_Stream* ftKey;
+        CPDF_CountedObject<CPDF_StreamAcc*>* ftData;
+        m_FontFileMap.GetNextAssoc(pos, ftKey, ftData);
+        nCount = ftData->m_nCount;
+        if (bForceRelease || nCount < 2) {
+            delete ftData->m_Obj;
+            delete ftData;
+            m_FontFileMap.RemoveKey(ftKey);
         }
     }
 }
 CPDF_Font* CPDF_DocPageData::GetFont(CPDF_Dictionary* pFontDict, FX_BOOL findOnly)
 {
     if (!pFontDict) {
         return NULL;
     }
     if (findOnly) {
         CPDF_CountedObject<CPDF_Font*>* fontData;
@@ skipping 384 matching lines @@
     m_FontFileMap.SetAt(pFontStream, ftData);
     return pFontFile;
 }
 void CPDF_DocPageData::ReleaseFontFileStreamAcc(CPDF_Stream* pFontStream, FX_BOOL bForce)
 {
     if (!pFontStream) {
         return;
     }
     PDF_DocPageData_Release<CPDF_Stream*, CPDF_StreamAcc*>(m_FontFileMap, pFontStream, NULL, bForce);
 }