commit 3df5c7cf7b585025bee1f5e30918dd475e5f4363
author Tom Sepez <tsepez@chromium.org> Wed Mar 06 18:45:55 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Mar 06 18:45:55 2019 +0000
tree ac73fcc1cae7c894975157ab8f27e945db635c4a
parent 9ba187ae47513a23ec6750e5b318da35d2cd29d6

Fix temporary going out of scope too early in XFA_LoadImageData()

Bug: chromium:937199
Change-Id: Id65195d32ecbd69b523552251b822d0367489ce8
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/51590
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

xfa/fxfa/parser/cxfa_node.cpp

diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index 96ac732..4fb4cd3 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -484,12 +484,13 @@
     return nullptr;
 
   FXCODEC_IMAGE_TYPE type = XFA_GetImageType(pImage->GetContentType());
+  ByteString bsData;  // Must outlive |pImageFileRead|.
   std::vector<uint8_t> buffer;
   RetainPtr<IFX_SeekableReadStream> pImageFileRead;
   if (wsImage.GetLength() > 0) {
     XFA_AttributeValue iEncoding = pImage->GetTransferEncoding();
     if (iEncoding == XFA_AttributeValue::Base64) {
-      ByteString bsData = wsImage.ToUTF8();
+      bsData = wsImage.ToUTF8();
       buffer.resize(bsData.GetLength());
       int32_t iRead = XFA_Base64Decode(bsData.c_str(), buffer.data());
       if (iRead > 0) {
@@ -497,8 +498,9 @@
             pdfium::make_span(buffer.data(), iRead));
       }
     } else {
-      pImageFileRead = pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(
-          wsImage.ToDefANSI().AsRawSpan());
+      bsData = wsImage.ToDefANSI();
+      pImageFileRead =
+          pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(bsData.AsRawSpan());
     }
   } else {
     WideString wsURL = wsHref;