commit 8e54f192f977824744cd14f04b6f35b79e0c42be
author Lei Zhang <thestig@chromium.org> Fri Sep 21 18:11:47 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Fri Sep 21 18:11:47 2018 +0000
tree 749b6a2b446eadeab251155b65e2c93443370b18
parent 214982c4d02a720c3b1b3de121cddc62189b8848

Fix destruction order with CPDF_StreamAcc.

Commit d39389f6 changed CPDF_StreamAcc to use MaybeOwned, so now callers
have to destroy it more carefully, so CPDF_StreamAcc does not end up
with a dangling pointer.

BUG=chromium:887626

Change-Id: Id5e7af96aad6270c444485c1574182da5dbd9ebf
Reviewed-on: https://pdfium-review.googlesource.com/42893
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

fpdfsdk/fpdf_flatten.cpp

diff --git a/fpdfsdk/fpdf_flatten.cpp b/fpdfsdk/fpdf_flatten.cpp
index cca28bc..01f3cd7 100644
--- a/fpdfsdk/fpdf_flatten.cpp
+++ b/fpdfsdk/fpdf_flatten.cpp
@@ -200,11 +200,13 @@
   pPage->ConvertToIndirectObjectFor(pdfium::page_object::kContents, pDocument);
   if (!pContentsArray) {
     pContentsArray = pDocument->NewIndirect<CPDF_Array>();
-    auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pContentsStream);
-    pAcc->LoadAllDataFiltered();
     ByteString sStream = "q\n";
-    ByteString sBody = ByteString(pAcc->GetData(), pAcc->GetSize());
-    sStream = sStream + sBody + "\nQ";
+    {
+      auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pContentsStream);
+      pAcc->LoadAllDataFiltered();
+      sStream += ByteString(pAcc->GetData(), pAcc->GetSize());
+      sStream += "\nQ";
+    }
     pContentsStream->SetDataAndRemoveFilter(sStream.AsRawSpan());
     pContentsArray->Add(pContentsStream->MakeReference(pDocument));
     pPage->SetFor(pdfium::page_object::kContents,

fpdfsdk/fpdf_ppo.cpp

diff --git a/fpdfsdk/fpdf_ppo.cpp b/fpdfsdk/fpdf_ppo.cpp
index 6313e43..4e47a00 100644
--- a/fpdfsdk/fpdf_ppo.cpp
+++ b/fpdfsdk/fpdf_ppo.cpp
@@ -711,16 +711,18 @@
       const CPDF_Stream* pStream = pSrcContentArray->GetStreamAt(i);
       auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
       pAcc->LoadAllDataFiltered();
-      ByteString bsStream(pAcc->GetData(), pAcc->GetSize());
-      bsSrcContentStream += bsStream;
+      bsSrcContentStream += ByteString(pAcc->GetData(), pAcc->GetSize());
       bsSrcContentStream += "\n";
     }
     pNewXObject->SetDataAndRemoveFilter(bsSrcContentStream.AsRawSpan());
   } else {
-    const CPDF_Stream* pStream = pSrcContentObj->AsStream();
-    auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
-    pAcc->LoadAllDataFiltered();
-    ByteString bsStream(pAcc->GetData(), pAcc->GetSize());
+    ByteString bsStream;
+    {
+      const CPDF_Stream* pStream = pSrcContentObj->AsStream();
+      auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
+      pAcc->LoadAllDataFiltered();
+      bsStream = ByteString(pAcc->GetData(), pAcc->GetSize());
+    }
     pNewXObject->SetDataAndRemoveFilter(bsStream.AsRawSpan());
   }
   return pNewXObject->GetObjNum();