commit 2c115d829d3560fd5082500c552dfe38850881ec
author Jun Fang <jun_fang@foxitsoftware.com> Tue Feb 23 09:36:10 2016 +0800
committer Jun Fang <jun_fang@foxitsoftware.com> Tue Feb 23 09:36:10 2016 +0800
tree d639f60563bcaa6727b9f32fe740d95270919056
parent 4f4de9a14eed86bb49340079b9bd43ed7a3caf70

Resolve heap-use-after-free in CFX_WideString::~CFX_WideString()

BUG=pdfium:402
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1719803002 .

xfa/include/fwl/lightwidget/listbox.h

diff --git a/xfa/include/fwl/lightwidget/listbox.h b/xfa/include/fwl/lightwidget/listbox.h
index 09bc018..b30f0f6 100644
--- a/xfa/include/fwl/lightwidget/listbox.h
+++ b/xfa/include/fwl/lightwidget/listbox.h
@@ -26,7 +26,7 @@
   FWL_HLISTITEM AddString(const CFX_WideStringC& wsAdd,
                           FX_BOOL bSelect = FALSE);
   FX_BOOL DeleteString(FWL_HLISTITEM hItem);
-  FX_BOOL DeleteAll();
+  void DeleteAll();
   int32_t CountSelItems();
   FWL_HLISTITEM GetSelItem(int32_t nIndexSel);
   int32_t GetSelIndex(int32_t nIndex);

xfa/src/fwl/src/lightwidget/listbox.cpp

diff --git a/xfa/src/fwl/src/lightwidget/listbox.cpp b/xfa/src/fwl/src/lightwidget/listbox.cpp
index 62e25cc..eb212fa 100644
--- a/xfa/src/fwl/src/lightwidget/listbox.cpp
+++ b/xfa/src/fwl/src/lightwidget/listbox.cpp
@@ -63,18 +63,10 @@
     pSel->m_dwStates |= FWL_ITEMSTATE_LTB_Selected;
   }
   m_ListBoxDP.m_ItemArray.erase(m_ListBoxDP.m_ItemArray.begin() + nIndex);
-  delete pDelItem;
   return TRUE;
 }
-FX_BOOL CFWL_ListBox::DeleteAll() {
-  size_t iCount = m_ListBoxDP.CountItems(m_pIface);
-  for (size_t i = 0; i < iCount; ++i) {
-    CFWL_ListItem* pItem =
-        reinterpret_cast<CFWL_ListItem*>(m_ListBoxDP.GetItem(m_pIface, i));
-    delete pItem;
-  }
+void CFWL_ListBox::DeleteAll() {
   m_ListBoxDP.m_ItemArray.clear();
-  return TRUE;
 }
 int32_t CFWL_ListBox::CountSelItems() {
   if (!m_pIface)