File 0029-Try-to-address-an-eventual-use-after-free-... of Package podofo

Overview Repositories Revisions Requests Users Attributes Meta

File 0029-Try-to-address-an-eventual-use-after-free-in-PdfObject.patch of Package podofo

Subject: Try to address an eventual use-after-free in PdfObject::operator=()
Url: https://sourceforge.net/p/podofo/code/1890/

Reported by clang:
 
 .../src/base/PdfObject.cpp:321:21: warning: Use of memory after it is freed
 m_pStream = m_pOwner->CreateStream( *(rhs.m_pStream) );
 ^ ~~~~~~~~~~~~~~~~
 .../src/base/PdfObject.cpp:303:30: note: Assuming rhs == *this
 const PdfObject & PdfObject::operator=( const PdfObject & rhs )
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 .../src/base/PdfObject.cpp:309:5: note: Memory is released
 delete m_pStream;
 ^~~~~~~~~~~~~~~~
 .../src/base/PdfObject.cpp:320:5: note: Taking true branch
 if( rhs.m_pStream )
 ^
 .../src/base/PdfObject.cpp:321:21: note: Use of memory after it is freed
 m_pStream = m_pOwner->CreateStream( *(rhs.m_pStream) );
 ^ ~~~~~~~~~~~~~~~~
 319| 
 320| if( rhs.m_pStream )
 321|-> m_pStream = m_pOwner->CreateStream( *(rhs.m_pStream) );
 322| 
 323| #if defined(PODOFO_EXTRA_CHECKS)

--- a/podofo/trunk/src/base/PdfObject.cpp
+++ b/podofo/trunk/src/base/PdfObject.cpp
@@ -302,11 +302,15 @@
 
 const PdfObject & PdfObject::operator=( const PdfObject & rhs )
 {
+    if( &rhs == this)
+        return *this;
+
     // DS: If you change this code, also change the copy constructor.
     //     As the copy constructor is called very often,
     //     it contains a copy of parts of this code to be faster.
 
     delete m_pStream;
+    m_pStream = NULL;
 
     const_cast<PdfObject*>(&rhs)->DelayedStreamLoad();

Places

File 0029-Try-to-address-an-eventual-use-after-free-in-PdfObject.patch of Package podofo

Places