tree 1072a389c69263a854d71e4317606ecd24682628
parent 43c511cb5f4da0f9ca98cd5f3e09410268d1c956
author Lei Zhang <thestig@chromium.org> 1442538537 -0700
committer Lei Zhang <thestig@chromium.org> 1442538537 -0700

Merge to M45: Fix heap use after free in CPDFSDK_Annot::GetPDFAnnot.

Use two seperate loops to kill current focus annot and to release annots
in current page. Loop to kill current focus annot is run first, so it
will not access deleted annots.

BUG=507316

TBR=tsepez@chromium.org

TEST=Reproduction steps mentioned in issue 507316 should not crash
     chrome.
     Unit test added to pdfium.
     Run pdfium_embeddertests.exe.

Review URL: https://codereview.chromium.org/1312313006 .

(cherry picked from commit 9241e5a43990859f6f9a94aaa2c488d0451039e3)

Review URL: https://codereview.chromium.org/1353063002 .