commit bd292ae8c0ca1793e8824add13bc8231cec3bc75
author Oliver Chang <ochang@chromium.org> Wed Jan 13 18:46:09 2016 -0800
committer Oliver Chang <ochang@chromium.org> Wed Jan 13 18:46:09 2016 -0800
tree f9c90ff5288681aa9d5550e23c5e278b6f794ab2
parent 81ec24c0fe046dcb7006ce69682c731a09205231

Merge to XFA: Fix some iterator invalidation issues while traversing CPDF_Dictionary.

Also fixes a potential issue in CPDF_Dictionary::ReplaceKey.

TBR=thestig@chromium.org
BUG=577030

Original Review URL: https://codereview.chromium.org/1582963003 .

(cherry picked from commit cae57daaa0f7ed4c92e22c4e7ef30392393d1128)

Review URL: https://codereview.chromium.org/1587703003 .

core/include/fpdfapi/fpdf_objects.h

diff --git a/core/include/fpdfapi/fpdf_objects.h b/core/include/fpdfapi/fpdf_objects.h
index 80d978e..92ce0b9 100644
--- a/core/include/fpdfapi/fpdf_objects.h
+++ b/core/include/fpdfapi/fpdf_objects.h
@@ -385,6 +385,7 @@
 
   FX_BOOL KeyExist(const CFX_ByteStringC& key) const;
 
+  // Set* functions invalidate iterators for the element with the key |key|.
   void SetAt(const CFX_ByteStringC& key, CPDF_Object* pObj);
 
   void SetAtName(const CFX_ByteStringC& key, const CFX_ByteString& name);
@@ -415,8 +416,10 @@
 
   void SetAtBoolean(const CFX_ByteStringC& key, FX_BOOL bValue);
 
+  // Invalidates iterators for the element with the key |key|.
   void RemoveAt(const CFX_ByteStringC& key);
 
+  // Invalidates iterators for the element with the key |oldkey|.
   void ReplaceKey(const CFX_ByteStringC& oldkey, const CFX_ByteStringC& newkey);
 
   FX_BOOL Identical(CPDF_Dictionary* pDict) const;

core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp

diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
index e0ce3fa..cad8d77 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
@@ -734,6 +734,9 @@
   // Avoid 2 constructions of CFX_ByteString.
   CFX_ByteString newkey_bytestring = newkey;
   auto new_it = m_Map.find(newkey_bytestring);
+  if (new_it == old_it)
+    return;
+
   if (new_it != m_Map.end()) {
     new_it->second->Release();
     new_it->second = old_it->second;

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 73da361..6f0fc76 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -885,9 +885,11 @@
                       if (!pRoot ||
                           (pRef && IsValidObjectNumber(pRef->GetRefObjNum()) &&
                            m_ObjectInfo[pRef->GetRefObjNum()].pos != 0)) {
-                        for (const auto& it : *pTrailer) {
-                          const CFX_ByteString& key = it.first;
-                          CPDF_Object* pElement = it.second;
+                        auto it = pTrailer->begin();
+                        while (it != pTrailer->end()) {
+                          const CFX_ByteString& key = it->first;
+                          CPDF_Object* pElement = it->second;
+                          ++it;
                           FX_DWORD dwObjNum =
                               pElement ? pElement->GetObjNum() : 0;
                           if (dwObjNum) {

fpdfsdk/src/fpdfppo.cpp

diff --git a/fpdfsdk/src/fpdfppo.cpp b/fpdfsdk/src/fpdfppo.cpp
index dac5481..47b9101 100644
--- a/fpdfsdk/src/fpdfppo.cpp
+++ b/fpdfsdk/src/fpdfppo.cpp
@@ -213,9 +213,11 @@
     }
     case PDFOBJ_DICTIONARY: {
       CPDF_Dictionary* pDict = pObj->AsDictionary();
-      for (const auto& it : *pDict) {
-        const CFX_ByteString& key = it.first;
-        CPDF_Object* pNextObj = it.second;
+      auto it = pDict->begin();
+      while (it != pDict->end()) {
+        const CFX_ByteString& key = it->first;
+        CPDF_Object* pNextObj = it->second;
+        ++it;
         if (!FXSYS_strcmp(key, "Parent") || !FXSYS_strcmp(key, "Prev") ||
             !FXSYS_strcmp(key, "First")) {
           continue;