diff options
| author | Miklos Vajna <vmiklos@collabora.co.uk> | 2018-03-02 11:18:21 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2018-04-07 13:19:17 +0200 |
| commit | 0c43c330159b9214fff2efe6d7a9c15e9f93adb4 (patch) | |
| tree | 0265bbfb0284edb77d6bdfafb38baf9dea8408c3 /vcl | |
| parent | e112fe434df84d2367d9efb83e9e1105a1394492 (diff) | |
forcepoint #16: fix heap-use-after-free
PDFDocument::Tokenize() in the aKeyword == "obj" case allocates a
PDFObjectElement, stores it as an owning pointer inside rElements, and
also stores two non-owning references to it in m_aOffsetObjects and
m_aIDObjects. So make sure those 2 other containers are also cleared
then elements go away.
LO_TRACE="valgrind" bin/run pdfverify <sample>
doesn't report errors anymore after the fix.
Reviewed-on: https://gerrit.libreoffice.org/50632
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 506d4cbc2f0dbef6f20f1199efcda805c9901d09)
Change-Id: Ie103de3e24a1080257a79e53b994e8536a9597bc
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/ipdf/pdfdocument.cxx | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/vcl/source/filter/ipdf/pdfdocument.cxx b/vcl/source/filter/ipdf/pdfdocument.cxx index 218d2140c9cc..b2c3a8577469 100644 --- a/vcl/source/filter/ipdf/pdfdocument.cxx +++ b/vcl/source/filter/ipdf/pdfdocument.cxx @@ -1280,8 +1280,10 @@ bool PDFDocument::Read(SvStream& rStream) if (pPrev) nStartXRef = pPrev->GetValue(); - // Reset state, except object offsets and the edit buffer. + // Reset state, except the edit buffer. m_aElements.clear(); + m_aOffsetObjects.clear(); + m_aIDObjects.clear(); m_aStartXRefs.clear(); m_aEOFs.clear(); m_pTrailer = nullptr; |