Remove pageview from map immediately
There seems to be an ownership issue in the page annotation code where removing
the annotations can result in removing the parent page view. This is fine except
that removing the parent page view removes the annotations and you can end up
with a use-after-free.
This CL removes the page view from the documents page map immediately and then
proceeds with the cleanup. Then, if we try to remove that page again it won't
be found and we won't double free.
BUG=chromium:630654
Review-Url: https://codereview.chromium.org/2179283005
diff --git a/fpdfsdk/fsdk_mgr.cpp b/fpdfsdk/fsdk_mgr.cpp
index 68143d2..d1e5507 100644
--- a/fpdfsdk/fsdk_mgr.cpp
+++ b/fpdfsdk/fsdk_mgr.cpp
@@ -353,9 +353,12 @@
if (pPageView->IsLocked())
return;
+ // Remove the page from the map to make sure we don't accidentally attempt
+ // to use the |pPageView| while we're cleaning it up.
+ m_pageMap.erase(it);
+
pPageView->KillFocusAnnotIfNeeded();
delete pPageView;
- m_pageMap.erase(it);
}
UnderlyingPageType* CPDFSDK_Document::GetPage(int nIndex) {
