diff options
| author | Robin Watts <robin.watts@artifex.com> | 2013-06-27 18:22:47 +0100 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2013-06-27 18:53:27 +0100 |
| commit | 260e54a956c54058051ce6ff31b36ad0ae1b60aa (patch) | |
| tree | 42ec426873ee4daa184b5747cbcbffeb4179101e | |
| parent | e8dca3f6f8aa63c5fecca401c8292f74f3a61b6d (diff) | |
| download | mupdf-260e54a956c54058051ce6ff31b36ad0ae1b60aa.tar.xz | |
Bug 694382: Fix problems arising from recent pdf_obj changes.
Thanks to zeniko for spotting these problems.
When we close a document, purge the glyph cache to ensure that
no type3 glyphs hang around with pointers to pdf_obj's that
are now gone.
Pass doc to pdf_new_obj_from_str rather than NULL. We believe
that the reason this needed to be NULL is no longer valid.
Also, revert to using an int for ref counts.
In a quick test of our regression suite we only found 2 files
that ever made a refcount > 256 (and they never got larger than
768), but the potential is there for issues. Reverting to an
int until we can think of a better idea.
| -rw-r--r-- | source/fitz/draw-glyph.c | 8 | ||||
| -rw-r--r-- | source/pdf/pdf-field.c | 3 | ||||
| -rw-r--r-- | source/pdf/pdf-object.c | 4 | ||||
| -rw-r--r-- | source/pdf/pdf-xref.c | 5 |
4 files changed, 16 insertions, 4 deletions
diff --git a/source/fitz/draw-glyph.c b/source/fitz/draw-glyph.c index b0a52949..6d026954 100644 --- a/source/fitz/draw-glyph.c +++ b/source/fitz/draw-glyph.c @@ -69,6 +69,14 @@ fz_evict_glyph_cache(fz_context *ctx) } void +fz_purge_glyph_cache(fz_context *ctx) +{ + fz_lock(ctx, FZ_LOCK_GLYPHCACHE); + fz_evict_glyph_cache(ctx); + fz_unlock(ctx, FZ_LOCK_GLYPHCACHE); +} + +void fz_drop_glyph_cache_context(fz_context *ctx) { if (!ctx->glyph_cache) diff --git a/source/pdf/pdf-field.c b/source/pdf/pdf-field.c index d8e1a240..2a2f07cc 100644 --- a/source/pdf/pdf-field.c +++ b/source/pdf/pdf-field.c @@ -12,8 +12,7 @@ pdf_obj *pdf_get_inheritable(pdf_document *doc, pdf_obj *obj, char *key) obj = pdf_dict_gets(obj, "Parent"); } - return fobj ? fobj - : pdf_dict_gets(pdf_dict_gets(pdf_dict_gets(pdf_trailer(doc), "Root"), "AcroForm"), key); + return fobj ? fobj : pdf_dict_gets(pdf_dict_gets(pdf_dict_gets(pdf_trailer(doc), "Root"), "AcroForm"), key); } int pdf_get_field_flags(pdf_document *doc, pdf_obj *obj) diff --git a/source/pdf/pdf-object.c b/source/pdf/pdf-object.c index aa20b79e..ddeffac0 100644 --- a/source/pdf/pdf-object.c +++ b/source/pdf/pdf-object.c @@ -29,7 +29,7 @@ enum struct pdf_obj_s { - unsigned short refs; + int refs; unsigned char kind; unsigned char flags; pdf_document *doc; @@ -1262,7 +1262,7 @@ pdf_obj *pdf_new_obj_from_str(pdf_document *doc, const char *src) pdf_lexbuf_init(ctx, &lexbuf, PDF_LEXBUF_SMALL); fz_try(ctx) { - result = pdf_parse_stm_obj(NULL, stream, &lexbuf); + result = pdf_parse_stm_obj(doc, stream, &lexbuf); } fz_always(ctx) { diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 1b693405..cc4a076b 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -1027,6 +1027,11 @@ pdf_close_document(pdf_document *doc) return; ctx = doc->ctx; + /* Type3 glyphs in the glyph cache can contain pdf_obj pointers + * that we are about to destroy. Simplest solution is to bin the + * glyph cache at this point. */ + fz_purge_glyph_cache(ctx); + pdf_drop_js(doc->js); pdf_free_xref_sections(doc); |