diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2018-09-13 18:31:38 +0800 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2018-09-13 19:39:33 +0800 |
| commit | 1ec022b2c58c361a19c18a15c2512fa06e5c328d (patch) | |
| tree | c5e6ad9df25282c228b977a32c0d4098052cb3b9 | |
| parent | a4e5e2ca509ce9e72dea55e4f88706d977355181 (diff) | |
| download | mupdf-1ec022b2c58c361a19c18a15c2512fa06e5c328d.tar.xz | |
Bug 699768: Drop default colorspaces even if page transformation fails.
pdf_page_transform() may throw due to a cycle in the page tree.
When this happened mupdf would previously forget to drop the
default colorspaces obtained, after this commit they are dropped.
Thanks to oss-fuzz for reporting.
| -rw-r--r-- | source/pdf/pdf-run.c | 28 |
1 files changed, 14 insertions, 14 deletions
diff --git a/source/pdf/pdf-run.c b/source/pdf/pdf-run.c index 4d607cc7..b0364435 100644 --- a/source/pdf/pdf-run.c +++ b/source/pdf/pdf-run.c @@ -16,23 +16,23 @@ pdf_run_annot_with_usage(fz_context *ctx, pdf_document *doc, pdf_page *page, pdf if (default_cs) fz_set_default_colorspaces(ctx, dev, default_cs); - pdf_page_transform(ctx, page, &mediabox, &page_ctm); - - flags = pdf_dict_get_int(ctx, annot->obj, PDF_NAME(F)); - if (flags & PDF_ANNOT_IS_NO_ROTATE) + fz_try(ctx) { - int rotate = pdf_to_int(ctx, pdf_dict_get_inheritable(ctx, page->obj, PDF_NAME(Rotate))); - fz_rect rect = pdf_dict_get_rect(ctx, annot->obj, PDF_NAME(Rect)); - fz_point tp = fz_transform_point_xy(rect.x0, rect.y1, page_ctm); - page_ctm = fz_concat(page_ctm, fz_translate(-tp.x, -tp.y)); - page_ctm = fz_concat(page_ctm, fz_rotate(-rotate)); - page_ctm = fz_concat(page_ctm, fz_translate(tp.x, tp.y)); - } + pdf_page_transform(ctx, page, &mediabox, &page_ctm); + + flags = pdf_dict_get_int(ctx, annot->obj, PDF_NAME(F)); + if (flags & PDF_ANNOT_IS_NO_ROTATE) + { + int rotate = pdf_to_int(ctx, pdf_dict_get_inheritable(ctx, page->obj, PDF_NAME(Rotate))); + fz_rect rect = pdf_dict_get_rect(ctx, annot->obj, PDF_NAME(Rect)); + fz_point tp = fz_transform_point_xy(rect.x0, rect.y1, page_ctm); + page_ctm = fz_concat(page_ctm, fz_translate(-tp.x, -tp.y)); + page_ctm = fz_concat(page_ctm, fz_rotate(-rotate)); + page_ctm = fz_concat(page_ctm, fz_translate(tp.x, tp.y)); + } - ctm = fz_concat(page_ctm, ctm); + ctm = fz_concat(page_ctm, ctm); - fz_try(ctx) - { proc = pdf_new_run_processor(ctx, dev, ctm, usage, NULL, default_cs); pdf_process_annot(ctx, proc, doc, page, annot, cookie); pdf_close_processor(ctx, proc); |