commit 7757143c12c972c9b0813b5b53cecba33544e7f8
author tsepez <tsepez@chromium.org> Fri Sep 23 12:21:10 2016 -0700
committer Commit bot <commit-bot@chromium.org> Fri Sep 23 12:21:10 2016 -0700
tree 80970d1293d42cb93254fa35ac8293776e0b16e9
parent 4dd613cb51c1d77ac2998f760325ed5b93f4ebf0

Avoid collisions in CPDF_IndirectObjectHolder::AddIndirectObject()

The change at 5b7c9bb differed from the original code in
that a pre-existing object would now be freed, which showed
that a collision could be possible if m_LastObjNum overflowed.

BUG=649206

Review-Url: https://codereview.chromium.org/2361303002

core/fpdfapi/fpdf_parser/cpdf_indirect_object_holder.cpp

diff --git a/core/fpdfapi/fpdf_parser/cpdf_indirect_object_holder.cpp b/core/fpdfapi/fpdf_parser/cpdf_indirect_object_holder.cpp
index 800e34b..0a15e2d 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_indirect_object_holder.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_indirect_object_holder.cpp
@@ -47,6 +47,7 @@
     return pObj->m_ObjNum;
 
   m_LastObjNum++;
+  m_IndirectObjs[m_LastObjNum].release();  // TODO(tsepez): stop this leak.
   m_IndirectObjs[m_LastObjNum].reset(pObj);
   pObj->m_ObjNum = m_LastObjNum;
   return m_LastObjNum;