Protect against a seg fault in CPDF_StructElementImpl constructor.

core/src/fpdfdoc/doc_tagged.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/fpdfapi/fpdf_parser.h"
 #include "../../include/fpdfapi/fpdf_page.h"
 #include "../../include/fpdfdoc/fpdf_tagged.h"
 #include "tagged_int.h"
@@ skipping 199 matching lines @@
         }
     }
     return TRUE;
 }
 CPDF_StructElementImpl::CPDF_StructElementImpl(CPDF_StructTreeImpl* pTree, CPDF_StructElementImpl* pParent, CPDF_Dictionary* pDict)
     : m_RefCount(0)
 {
     m_pTree = pTree;
     m_pDict = pDict;
     m_Type = pDict->GetString(FX_BSTRC("S"));
-    CFX_ByteString mapped = pTree->m_pRoleMap->GetString(m_Type);
-    if (!mapped.IsEmpty()) {
-        m_Type = mapped;
+    if (pTree->m_pRoleMap != NULL) {

[Tom Sepez, 2014/11/05 17:57:03]

nit: != NULL is redundant. Just 
   if (pTree->m_pRoleMap) {

[olsen, 2014/11/10 00:24:43]

Done.

+        CFX_ByteString mapped = pTree->m_pRoleMap->GetString(m_Type);
+        if (!mapped.IsEmpty()) {
+            m_Type = mapped;
+        }
     }
     m_pParent = pParent;
     LoadKids(pDict);
 }
 CPDF_StructElementImpl::~CPDF_StructElementImpl()
 {
     for (int i = 0; i < m_Kids.GetSize(); i ++) {
         if (m_Kids[i].m_Type == CPDF_StructKid::Element && m_Kids[i].m_Element.m_pElement) {
             ((CPDF_StructElementImpl*)m_Kids[i].m_Element.m_pElement)->Release();
         }
@@ skipping 209 matching lines @@
     return pAttr->GetNumber();
 }
 int     CPDF_StructElementImpl::GetInteger(FX_BSTR owner, FX_BSTR name, int default_value, FX_BOOL bInheritable, int subindex)
 {
     CPDF_Object* pAttr = GetAttr(owner, name, bInheritable, subindex);
     if (pAttr == NULL || pAttr->GetType() != PDFOBJ_NUMBER) {
         return default_value;
     }
     return pAttr->GetInteger();
 }