Fix a double-free issue in CFX_PathData::~CFX_PathData

Fix a double-free issue in CFX_PathData::~CFX_PathData

In CPDFSDK_InterForm::SubmitFields, the buffer pointed by m_pBuffer is returned
and released by the caller. However, it will be released again in the destructor.

BUG=401580
R=tsepez@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/39a97ea

[jun_fang, 2014-08-17 06:38:55]

Hi Tom, please review this change. Thanks!

[Tom Sepez, 2014-08-18 18:13:09]

On 2014/08/17 06:38:55, jun_fang wrote:
> Hi Tom, please review this change. Thanks!
How about setting the pointer to NULL in 
CPDFSDK_InterForm::SubmitFields when its freed?  Then we don't need to change
the destructor, and things get cleaned up even when
CPDFSDK_InterForm::SubmitFields isn't called?

[jun_fang, 2014-08-18 19:00:16]

On 2014/08/18 18:13:09, Tom Sepez wrote:
> On 2014/08/17 06:38:55, jun_fang wrote:
> > Hi Tom, please review this change. Thanks!
> How about setting the pointer to NULL in 
> CPDFSDK_InterForm::SubmitFields when its freed?  Then we don't need to change
> the destructor, and things get cleaned up even when
> CPDFSDK_InterForm::SubmitFields isn't called?

What you mentioned is the current implementation. It has the following problem:
 
FX_LPBYTE pBuffer = textBuf.GetBuffer(); //in CPDFSDK_InterForm::SubmitFields
So pBuffer and m_pBuffer points to the same buffer.
When we release the buffer pointed by pBuffer and set it as NULL, m_pBuffer
still
points to this buffer. It will be released again in the destructor.

[Tom Sepez, 2014-08-18 19:07:48]

> So pBuffer and m_pBuffer points to the same buffer.
> When we release the buffer pointed by pBuffer and set it as NULL, m_pBuffer
> still
> points to this buffer. It will be released again in the destructor.

Sounds like pBuffer shouldn't be freed, and we'll just let the destructor do
that. Why do we think that we need to free pBuffer?  GetBuffer() doesn't imply a
change in ownership.

[jun_fang, 2014-08-18 19:10:55]

On 2014/08/18 19:07:48, Tom Sepez wrote:
> > So pBuffer and m_pBuffer points to the same buffer.
> > When we release the buffer pointed by pBuffer and set it as NULL, m_pBuffer
> > still
> > points to this buffer. It will be released again in the destructor.
> 
> Sounds like pBuffer shouldn't be freed, and we'll just let the destructor do
> that. Why do we think that we need to free pBuffer?  GetBuffer() doesn't imply
a
> change in ownership.

You are right. So in this fix, I removed the free of pBuffer.

[Tom Sepez, 2014-08-18 19:16:14]

> You are right. So in this fix, I removed the free of pBuffer.
LGTM.  I misread your fix as being in the destructor.  My fault for not
expanding enough.

[jun_fang, 2014-08-18 19:22:02]

Committed patchset #1 manually as 39a97ea (presubmit successful).