RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 01:37:34 +00:00
Code Issues Activity Actions

LibPDF: Fix two use-after-frees

Browse source 
Two lambdas were capturing locals that were out of scope by the
time the lambdas ran.

With this, `pdf` can successfully load and print the page count of
pdf_reference_1.7.pdf.
This commit is contained in:
Nico Weber 2023-07-10 11:21:16 -04:00 • committed by Sam Atkins
parent 6111a9f9d0
commit 826c0426f3
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Userland/Libraries/LibPDF/Encryption.cpp
View file

@ -323,8 +323,8 @@ void StandardSecurityHandler::encrypt(NonnullRefPtr<Object> object, Reference re
auto stream = object->cast<StreamObject>(); auto stream = object->cast<StreamObject>();
bytes = stream->bytes(); bytes = stream->bytes();
assign = [&stream](ByteBuffer const& buffer) { assign = [&object](ByteBuffer const& buffer) {
stream->buffer() = buffer; object->cast<StreamObject>()->buffer() = buffer;
}; };
if (stream->dict()->contains(CommonNames::Filter)) { if (stream->dict()->contains(CommonNames::Filter)) {
@ -335,8 +335,8 @@ void StandardSecurityHandler::encrypt(NonnullRefPtr<Object> object, Reference re
} else if (object->is<StringObject>()) { } else if (object->is<StringObject>()) {
auto string = object->cast<StringObject>(); auto string = object->cast<StringObject>();
bytes = string->string().bytes(); bytes = string->string().bytes();
assign = [&string](ByteBuffer const& buffer) { assign = [&object](ByteBuffer const& buffer) {
string->set_string(DeprecatedString(buffer.bytes())); object->cast<StringObject>()->set_string(DeprecatedString(buffer.bytes()));
}; };
} else { } else {
VERIFY_NOT_REACHED(); VERIFY_NOT_REACHED();