fix a crash issue in _CMapLookupCallback
authorfoxit <jun_fang@foxitsoftware.com>
Mon, 7 Jul 2014 21:06:56 +0000 (14:06 -0700)
committerfoxit <jun_fang@foxitsoftware.com>
Mon, 7 Jul 2014 21:06:56 +0000 (14:06 -0700)
BUG=382242
R=palmer@chromium.org

Review URL: https://codereview.chromium.org/341333004

core/include/fpdfapi/fpdf_objects.h
core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

index a41ff08..1b7cb94 100644 (file)
@@ -49,6 +49,11 @@ public:
         return m_ObjNum;
     }
 
+    FX_DWORD                            GetGenNum() const
+    {
+        return m_GenNum;
+    }
+
     FX_BOOL                                    IsIdentical(CPDF_Object* pObj) const;
 
     CPDF_Object*                       Clone(FX_BOOL bDirect = FALSE) const;
@@ -90,9 +95,11 @@ protected:
     CPDF_Object()
     {
         m_ObjNum = 0;
+        m_GenNum = 0;
     }
 
     FX_DWORD                           m_ObjNum;
+    FX_DWORD                           m_GenNum;
 
     void                                       Destroy();
 
index 6c93bcb..e945ab5 100644 (file)
@@ -1271,9 +1271,15 @@ void CPDF_IndirectObjects::InsertIndirectObject(FX_DWORD objnum, CPDF_Object* pO
     if (objnum == 0 || pObj == NULL) {
         return;
     }
-    FX_LPVOID value;
+    FX_LPVOID value = NULL;
     if (m_IndirectObjs.Lookup((FX_LPVOID)(FX_UINTPTR)objnum, value)) {
-        ((CPDF_Object*)value)->Destroy();
+        if (value)
+        {
+            if (pObj->GetGenNum() <= ((CPDF_Object*)value)->GetGenNum())
+                return;
+            else 
+                ((CPDF_Object*)value)->Destroy();
+         }         
     }
     pObj->m_ObjNum = objnum;
     m_IndirectObjs.SetAt((FX_LPVOID)(FX_UINTPTR)objnum, pObj);
index b9e5359..3bfd37f 100644 (file)
@@ -1384,6 +1384,7 @@ CPDF_Object* CPDF_Parser::ParseIndirectObjectAt(CPDF_IndirectObjects* pObjList,
     m_Syntax.RestorePos(SavedPos);
     if (pObj && !objnum) {
         pObj->m_ObjNum = real_objnum;
+        pObj->m_GenNum = gennum;
     }
     return pObj;
 }