Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

core/src/fpdfapi/fpdf_page/fpdf_page_graph_state.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../include/fpdfapi/fpdf_pageobj.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
@@ skipping 267 matching lines @@
     FX_BOOL ret = pData->m_StrokeColor.GetRGB(R, G, B);
     if (pPattern->m_PatternType == 1 && ((CPDF_TilingPattern*)pPattern)->m_bColored && !ret) {
         pData->m_StrokeRGB = 0x00BFBFBF;
         return;
     }
     pData->m_StrokeRGB = pData->m_StrokeColor.GetRGB(R, G, B) ? FXSYS_RGB(R, G, B) : (FX_DWORD) - 1;
 }
 CPDF_TextStateData::CPDF_TextStateData()
 {
     m_pFont = NULL;
+    m_pDocument = NULL;
     m_FontSize = 1.0f;
     m_WordSpace = 0;
     m_CharSpace = 0;
     m_TextMode = 0;
     m_Matrix[0] = m_Matrix[3] = 1.0f;
     m_Matrix[1] = m_Matrix[2] = 0;
     m_CTM[0] = m_CTM[3] = 1.0f;
     m_CTM[1] = m_CTM[2] = 0;
 }
 CPDF_TextStateData::CPDF_TextStateData(const CPDF_TextStateData& src)
 {
+    if (this == &src) {
+        return;
+    }
     FXSYS_memcpy32(this, &src, sizeof(CPDF_TextStateData));
-    if (m_pFont && m_pFont->m_pDocument) {
-        m_pFont = m_pFont->m_pDocument->GetPageData()->GetFont(m_pFont->GetFontDict(), FALSE);
+    if (m_pDocument && m_pFont) {
+        m_pFont = m_pDocument->GetPageData()->GetFont(m_pFont->GetFontDict(), FALSE);
     }
 }
 CPDF_TextStateData::~CPDF_TextStateData()
 {
-    CPDF_Font* pFont = m_pFont;
-    if (pFont && pFont->m_pDocument) {
-        pFont->m_pDocument->GetPageData()->ReleaseFont(pFont->GetFontDict());
+    if (m_pDocument && m_pFont) {
+        CPDF_DocPageData *pPageData = m_pDocument->GetPageData();
+        if (pPageData && !pPageData->IsForceClear()) {
+            pPageData->ReleaseFont(m_pFont->GetFontDict());
+        }
     }
 }
 void CPDF_TextState::SetFont(CPDF_Font* pFont)
 {
-    CPDF_Font*& pStateFont = GetModify()->m_pFont;
-    CPDF_DocPageData* pDocPageData = NULL;
-    if (pStateFont && pStateFont->m_pDocument) {
-        pDocPageData = pStateFont->m_pDocument->GetPageData();
-        pDocPageData->ReleaseFont(pStateFont->GetFontDict());
+    CPDF_TextStateData* pStateData = GetModify();
+    if (pStateData) {
+        CPDF_Document* pDoc = pStateData->m_pDocument;
+        CPDF_DocPageData *pPageData = pDoc ? pDoc->GetPageData() : NULL;
+        if (pPageData && pStateData->m_pFont && !pPageData->IsForceClear()) {
+            pPageData->ReleaseFont(pStateData->m_pFont->GetFontDict());
+        }
+        pStateData->m_pDocument = pFont ? pFont->m_pDocument : NULL;
+        pStateData->m_pFont = pFont;
     }
-    pStateFont = pFont;
 }
 FX_FLOAT CPDF_TextState::GetFontSizeV() const
 {
     FX_FLOAT* pMatrix = GetMatrix();
     FX_FLOAT unit = FXSYS_sqrt2(pMatrix[1], pMatrix[3]);
     FX_FLOAT size = FXSYS_Mul(unit, GetFontSize());
     return (FX_FLOAT)FXSYS_fabs(size);
 }
 FX_FLOAT CPDF_TextState::GetFontSizeH() const
 {
@@ skipping 368 matching lines @@
             pDict = NULL;
             if (item.GetParamType() == CPDF_ContentMarkItem::PropertiesDict ||
                     item.GetParamType() == CPDF_ContentMarkItem::DirectDict) {
                 pDict = (CPDF_Dictionary*)item.GetParam();
             }
             return TRUE;
         }
     }
     return FALSE;
 }