File 0029-Try-to-address-an-eventual-use-after-free-in-PdfObject.patch of Package podofo
Subject: Try to address an eventual use-after-free in PdfObject::operator=()
Url: https://sourceforge.net/p/podofo/code/1890/
Reported by clang:
.../src/base/PdfObject.cpp:321:21: warning: Use of memory after it is freed
m_pStream = m_pOwner->CreateStream( *(rhs.m_pStream) );
^ ~~~~~~~~~~~~~~~~
.../src/base/PdfObject.cpp:303:30: note: Assuming rhs == *this
const PdfObject & PdfObject::operator=( const PdfObject & rhs )
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.../src/base/PdfObject.cpp:309:5: note: Memory is released
delete m_pStream;
^~~~~~~~~~~~~~~~
.../src/base/PdfObject.cpp:320:5: note: Taking true branch
if( rhs.m_pStream )
^
.../src/base/PdfObject.cpp:321:21: note: Use of memory after it is freed
m_pStream = m_pOwner->CreateStream( *(rhs.m_pStream) );
^ ~~~~~~~~~~~~~~~~
319|
320| if( rhs.m_pStream )
321|-> m_pStream = m_pOwner->CreateStream( *(rhs.m_pStream) );
322|
323| #if defined(PODOFO_EXTRA_CHECKS)
--- a/podofo/trunk/src/base/PdfObject.cpp
+++ b/podofo/trunk/src/base/PdfObject.cpp
@@ -302,11 +302,15 @@
const PdfObject & PdfObject::operator=( const PdfObject & rhs )
{
+ if( &rhs == this)
+ return *this;
+
// DS: If you change this code, also change the copy constructor.
// As the copy constructor is called very often,
// it contains a copy of parts of this code to be faster.
delete m_pStream;
+ m_pStream = NULL;
const_cast<PdfObject*>(&rhs)->DelayedStreamLoad();