diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2018-01-29 02:00:48 +0100 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2018-02-01 17:13:41 +0100 |
| commit | 26527eef77b3e51c2258c8e40845bfbc015e405d (patch) | |
| tree | c813da7c64be4a04ad59421b19ff824bb13d1fff | |
| parent | ab98356f959c7a6e94b1ec10f78dd2c33ed3f3e7 (diff) | |
| download | mupdf-26527eef77b3e51c2258c8e40845bfbc015e405d.tar.xz | |
Bug 698830: Don't drop unkept stream if running out of error stack.
Under normal conditions where fz_keep_stream() is called inside
fz_try() we may call fz_drop_stream() in fz_catch() upon exceptions.
The issue comes when fz_keep_stream() has not yet been called but is
dropped in fz_catch(). This happens in the PDF from the bug when
fz_try() runs out of exception stack, and next the code in fz_catch()
runs, dropping the caller's reference to the filter chain stream!
The simplest way of fixing this it to always keep the filter chain
stream before fz_try() is called. That way fz_catch() may drop the
stream whether an exception has occurred or if the fz_try() ran out of
exception stack.
| -rw-r--r-- | source/pdf/pdf-stream.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/source/pdf/pdf-stream.c b/source/pdf/pdf-stream.c index c89da5c4..c6ba7ad3 100644 --- a/source/pdf/pdf-stream.c +++ b/source/pdf/pdf-stream.c @@ -303,14 +303,13 @@ pdf_open_raw_filter(fz_context *ctx, fz_stream *chain, pdf_document *doc, pdf_ob *orig_gen = 0; } - fz_var(chain); + chain = fz_keep_stream(ctx, chain); fz_try(ctx) { len = pdf_to_int(ctx, pdf_dict_get(ctx, stmobj, PDF_NAME_Length)); - /* don't close chain when we close this filter */ - chain2 = fz_keep_stream(ctx, chain); + chain2 = chain; chain = NULL; chain = fz_open_null(ctx, chain2, len, offset); |