diff options
author | 2013-02-05 23:13:39 +0000 | |
---|---|---|
committer | 2013-02-05 23:13:39 +0000 | |
commit | 2e6a69b7a23e88e54d8b4a9ee3f4f9e4cc0695a7 (patch) | |
tree | 8daf2e75cd842978fdcc888d4aa919ed5f5b4440 /src/pdf | |
parent | 55cac11d8ef30a7045827f762d86d71994565dea (diff) |
If the stack is too deep we could get Stack Overflow in pdf's ContentEntry's destructor.
Review URL: https://codereview.appspot.com/7313045
git-svn-id: http://skia.googlecode.com/svn/trunk@7605 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'src/pdf')
-rw-r--r-- | src/pdf/SkPDFDevice.cpp | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/pdf/SkPDFDevice.cpp b/src/pdf/SkPDFDevice.cpp index e253a5fc35..00411a195a 100644 --- a/src/pdf/SkPDFDevice.cpp +++ b/src/pdf/SkPDFDevice.cpp @@ -495,6 +495,22 @@ struct ContentEntry { GraphicStateEntry fState; SkDynamicMemoryWStream fContent; SkTScopedPtr<ContentEntry> fNext; + + // If the stack is too deep we could get Stack Overflow. + // So we manually destruct the object. + ~ContentEntry() { + ContentEntry* val = fNext.release(); + if (NULL == val) { + return; + } + + while (val != NULL) { + ContentEntry* valNext = val->fNext.release(); + // When the destructor is called, fNext is NULL and exits. + delete val; + val = valNext; + } + } }; // A helper class to automatically finish a ContentEntry at the end of a |