fix a crash issue in _CMapLookupCallback BUG=382242 R=palmer@chromium.org Review URL: https://codereview.chromium.org/341333004
diff --git a/core/include/fpdfapi/fpdf_objects.h b/core/include/fpdfapi/fpdf_objects.h index a41ff08..1b7cb94 100644 --- a/core/include/fpdfapi/fpdf_objects.h +++ b/core/include/fpdfapi/fpdf_objects.h
@@ -49,6 +49,11 @@ return m_ObjNum; } + FX_DWORD GetGenNum() const + { + return m_GenNum; + } + FX_BOOL IsIdentical(CPDF_Object* pObj) const; CPDF_Object* Clone(FX_BOOL bDirect = FALSE) const; @@ -90,9 +95,11 @@ CPDF_Object() { m_ObjNum = 0; + m_GenNum = 0; } FX_DWORD m_ObjNum; + FX_DWORD m_GenNum; void Destroy();
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp index 6c93bcb..e945ab5 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
@@ -1271,9 +1271,15 @@ if (objnum == 0 || pObj == NULL) { return; } - FX_LPVOID value; + FX_LPVOID value = NULL; if (m_IndirectObjs.Lookup((FX_LPVOID)(FX_UINTPTR)objnum, value)) { - ((CPDF_Object*)value)->Destroy(); + if (value) + { + if (pObj->GetGenNum() <= ((CPDF_Object*)value)->GetGenNum()) + return; + else + ((CPDF_Object*)value)->Destroy(); + } } pObj->m_ObjNum = objnum; m_IndirectObjs.SetAt((FX_LPVOID)(FX_UINTPTR)objnum, pObj);
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp index b9e5359..3bfd37f 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1384,6 +1384,7 @@ m_Syntax.RestorePos(SavedPos); if (pObj && !objnum) { pObj->m_ObjNum = real_objnum; + pObj->m_GenNum = gennum; } return pObj; }