More reference counting cleanups.

8 files changed, 66 insertions, 78 deletions

diff --git a/mupdf/pdf_function.c b/mupdf/pdf_function.c
index 547b5e04..86cda433 100644
--- a/mupdf/pdf_function.c
+++ b/mupdf/pdf_function.c
@@ -1479,7 +1479,6 @@ pdf_loadfunction(pdf_function **funcp, pdf_xref *xref, fz_obj *ref)
 	if (func->m >= MAXM || func->n >= MAXN)
 	{
 		fz_free(func);
-		fz_dropobj(dict);
 		return fz_throw("assert: /Domain or /Range too big");
 	}
 
@@ -1490,7 +1489,6 @@ pdf_loadfunction(pdf_function **funcp, pdf_xref *xref, fz_obj *ref)
 		if (error)
 		{
 			pdf_dropfunction(func);
-			fz_dropobj(dict);
 			return fz_rethrow(error, "cannot load sampled function (%d %d R)", fz_tonum(ref), fz_togen(ref));
 		}
 		break;
@@ -1500,7 +1498,6 @@ pdf_loadfunction(pdf_function **funcp, pdf_xref *xref, fz_obj *ref)
 		if (error)
 		{
 			pdf_dropfunction(func);
-			fz_dropobj(dict);
 			return fz_rethrow(error, "cannot load exponential function (%d %d R)", fz_tonum(ref), fz_togen(ref));
 		}
 		break;
@@ -1510,7 +1507,6 @@ pdf_loadfunction(pdf_function **funcp, pdf_xref *xref, fz_obj *ref)
 		if (error)
 		{
 			pdf_dropfunction(func);
-			fz_dropobj(dict);
 			return fz_rethrow(error, "cannot load stitching function (%d %d R)", fz_tonum(ref), fz_togen(ref));
 		}
 		break;
@@ -1520,26 +1516,21 @@ pdf_loadfunction(pdf_function **funcp, pdf_xref *xref, fz_obj *ref)
 		if (error)
 		{
 			pdf_dropfunction(func);
-			fz_dropobj(dict);
 			return fz_rethrow(error, "cannot load calculator function (%d %d R)", fz_tonum(ref), fz_togen(ref));
 		}
 		break;
 
 	default:
 		fz_free(func);
-		fz_dropobj(dict);
 		return fz_throw("unknown function type (%d %d R)", fz_tonum(ref), fz_togen(ref));
 	}
 
-	fz_dropobj(dict);
-
 	pdf_logrsrc("}\n");
 
 	error = pdf_storeitem(xref->store, PDF_KFUNCTION, ref, func);
 	if (error)
 	{
 		pdf_dropfunction(func);
-		fz_dropobj(dict);
 		return fz_rethrow(error, "cannot store function resource");
 	}
 
diff --git a/mupdf/pdf_nametree.c b/mupdf/pdf_nametree.c
index cc4511aa..8a3f7fed 100644
--- a/mupdf/pdf_nametree.c
+++ b/mupdf/pdf_nametree.c
@@ -78,7 +78,7 @@ pdf_loadnametrees(pdf_xref *xref)
 	dests = fz_dictgets(xref->root, "Dests");
 	if (dests)
 	{
-		xref->dests = dests;
+		xref->dests = fz_keepobj(dests);
 		return fz_okay;
 	}
 
diff --git a/mupdf/pdf_open.c b/mupdf/pdf_open.c
index c5871597..c3e96224 100644
--- a/mupdf/pdf_open.c
+++ b/mupdf/pdf_open.c
@@ -615,6 +615,7 @@ pdf_loadobjstm(pdf_xref *xref, int oid, int gen, char *buf, int cap)
 
 		if (oidbuf[i] < 1 || oidbuf[i] >= xref->len)
 		{
+			fz_dropobj(obj);
 			error = fz_throw("object id (%d 0 R) out of range (0..%d)", oidbuf[i], xref->len - 1);
 			goto cleanupstm;
 		}
diff --git a/mupdf/pdf_page.c b/mupdf/pdf_page.c
index ac03d553..61e10f62 100644
--- a/mupdf/pdf_page.c
+++ b/mupdf/pdf_page.c
@@ -225,12 +225,19 @@ pdf_loadpage(pdf_page **pagep, pdf_xref *xref, fz_obj *dict)
 
 	error = loadpagecontents(&tree, xref, rdb, obj);
 	if (error)
+	{
+		fz_dropobj(rdb);
 		return fz_rethrow(error, "cannot load page contents");
+	}
 
 	pdf_logpage("optimize tree\n");
 	error = fz_optimizetree(tree);
 	if (error)
+	{
+		fz_droptree(tree);
+		fz_dropobj(rdb);
 		return fz_rethrow(error, "cannot optimize page display tree");
+	}
 
 	/*
 	 * Create page object
diff --git a/mupdf/pdf_pattern.c b/mupdf/pdf_pattern.c
index 1c1491b6..9ac6926c 100644
--- a/mupdf/pdf_pattern.c
+++ b/mupdf/pdf_pattern.c
@@ -73,8 +73,8 @@ pdf_loadpattern(pdf_pattern **patp, pdf_xref *xref, fz_obj *dict, fz_obj *stmref
 	error = pdf_storeitem(xref->store, PDF_KPATTERN, stmref, pat);
 	if (error)
 	{
-		error = fz_rethrow(error, "cannot store pattern resource");
-		goto cleanupstore;
+		pdf_droppattern(pat);
+		return fz_rethrow(error, "cannot store pattern resource");
 	}
 
 	/*
@@ -103,6 +103,7 @@ pdf_loadpattern(pdf_pattern **patp, pdf_xref *xref, fz_obj *dict, fz_obj *stmref
 	error = pdf_newcsi(&csi, pat->ismask);
 	if (error)
 	{
+		fz_dropobj(resources);
 		error = fz_rethrow(error, "cannot create interpreter");
 		goto cleanup;
 	}
@@ -110,27 +111,33 @@ pdf_loadpattern(pdf_pattern **patp, pdf_xref *xref, fz_obj *dict, fz_obj *stmref
 	error = pdf_openstream(&stm, xref, fz_tonum(stmref), fz_togen(stmref));
 	if (error)
 	{
+		pdf_dropcsi(csi);
+		fz_dropobj(resources);
 		error = fz_rethrow(error, "cannot open pattern stream (%d %d R)", fz_tonum(stmref), fz_togen(stmref));
-		goto cleanupcsi;
+		goto cleanup;
 	}
 
 	error = pdf_runcsi(csi, xref, resources, stm);
-
-	fz_dropstream(stm);
-
 	if (error)
 	{
+		fz_dropstream(stm);
+		pdf_dropcsi(csi);
+		fz_dropobj(resources);
 		error = fz_rethrow(error, "cannot interpret pattern stream (%d %d R)", fz_tonum(stmref), fz_togen(stmref));
-		goto cleanupcsi;
+		goto cleanup;
 	}
 
-	pat->tree = csi->tree;
-	csi->tree = nil;
-
+	fz_dropstream(stm);
 	pdf_dropcsi(csi);
-
 	fz_dropobj(resources);
 
+	/*
+	 *  Move display list to pattern struct
+	 */
+
+	pat->tree = csi->tree;
+	csi->tree = nil;
+
 	pdf_logrsrc("optimize tree\n");
 	error = fz_optimizetree(pat->tree);
 	if (error)
@@ -144,11 +151,8 @@ pdf_loadpattern(pdf_pattern **patp, pdf_xref *xref, fz_obj *dict, fz_obj *stmref
 	*patp = pat;
 	return fz_okay;
 
-cleanupcsi:
-	pdf_dropcsi(csi);
 cleanup:
 	pdf_removeitem(xref->store, PDF_KPATTERN, stmref);
-cleanupstore:
 	pdf_droppattern(pat);
 	return error; /* already rethrown */
 }
diff --git a/mupdf/pdf_repair.c b/mupdf/pdf_repair.c
index 061ee3b1..c43310f5 100644
--- a/mupdf/pdf_repair.c
+++ b/mupdf/pdf_repair.c
@@ -15,46 +15,52 @@ struct entry
 };
 
 static fz_error parseobj(fz_stream *file, char *buf, int cap,
-	int *stmofs, int *stmlen, int *isroot, int *isinfo)
+	int *stmofsp, int *stmlenp, int *isroot, int *isinfo)
 {
 	fz_error error;
-	fz_obj *dict = nil;
-	fz_obj *length;
-	fz_obj *filter;
-	fz_obj *type;
 	pdf_token_e tok;
+	int stmlen;
 	int len;
 	int n;
 
-	*stmlen = -1;
+	*stmofsp = 0;
+	*stmlenp = -1;
 	*isroot = 0;
 	*isinfo = 0;
 
+	stmlen = 0;
+
 	error = pdf_lex(&tok, file, buf, cap, &len);
 	if (tok == PDF_TODICT)
 	{
+		fz_obj *dict, *obj;
+
+		/* Send nil xref so we don't try to resolve references */
 		error = pdf_parsedict(&dict, nil, file, buf, cap);
 		if (error)
 			return fz_rethrow(error, "cannot parse object");
-	}
 
-	if (fz_isdict(dict))
-	{
-		type = fz_dictgets(dict, "Type");
-		if (fz_isname(type) && !strcmp(fz_toname(type), "Catalog"))
+		obj = fz_dictgets(dict, "Type");
+		if (fz_isname(obj) && !strcmp(fz_toname(obj), "Catalog"))
 			*isroot = 1;
 
-		filter = fz_dictgets(dict, "Filter");
-		if (fz_isname(filter) && !strcmp(fz_toname(filter), "Standard"))
+		if (fz_dictgets(dict, "Producer"))
+			if (fz_dictgets(dict, "Creator"))
+				if (fz_dictgets(dict, "Title"))
+					*isinfo = 1;
+
+		obj = fz_dictgets(dict, "Length");
+		if (fz_isint(obj))
+			stmlen = fz_toint(obj);
+
+		obj = fz_dictgets(dict, "Filter");
+		if (fz_isname(obj) && !strcmp(fz_toname(obj), "Standard"))
 		{
 			fz_dropobj(dict);
 			return fz_throw("cannot repair encrypted files");
 		}
 
-		if (fz_dictgets(dict, "Producer"))
-			if (fz_dictgets(dict, "Creator"))
-				if (fz_dictgets(dict, "Title"))
-					*isinfo = 1;
+		fz_dropobj(dict);
 	}
 
 	while ( tok != PDF_TSTREAM &&
@@ -80,14 +86,13 @@ static fz_error parseobj(fz_stream *file, char *buf, int cap,
 		if (error)
 			return fz_rethrow(error, "cannot read from file");
 
-		*stmofs = fz_tell(file);
-		if (*stmofs < 0)
+		*stmofsp = fz_tell(file);
+		if (*stmofsp < 0)
 			return fz_throw("cannot seek in file");
 
-		length = fz_dictgets(dict, "Length");
-		if (fz_isint(length))
+		if (stmlen > 0)
 		{
-			error = fz_seek(file, *stmofs + fz_toint(length), 0);
+			error = fz_seek(file, *stmofsp + stmlen, 0);
 			if (error)
 				return fz_rethrow(error, "cannot seek in file");
 			error = pdf_lex(&tok, file, buf, cap, &len);
@@ -95,7 +100,7 @@ static fz_error parseobj(fz_stream *file, char *buf, int cap,
 				return fz_rethrow(error, "cannot scan for endstream token");
 			if (tok == PDF_TENDSTREAM)
 				goto atobjend;
-			error = fz_seek(file, *stmofs, 0);
+			error = fz_seek(file, *stmofsp, 0);
 			if (error)
 				return fz_rethrow(error, "cannot seek in file");
 		}
@@ -117,7 +122,7 @@ static fz_error parseobj(fz_stream *file, char *buf, int cap,
 		if (error)
 			return fz_rethrow(error, "cannot read from file");
 
-		*stmlen = fz_tell(file) - *stmofs - 9;
+		*stmlenp = fz_tell(file) - *stmofsp - 9;
 
 atobjend:
 		error = pdf_lex(&tok, file, buf, cap, &len);
@@ -127,9 +132,6 @@ atobjend:
 			;
 	}
 
-	if (dict)
-		fz_dropobj(dict);
-
 	return fz_okay;
 }
 
diff --git a/mupdf/pdf_store.c b/mupdf/pdf_store.c
index caa823ab..847e9bcb 100644
--- a/mupdf/pdf_store.c
+++ b/mupdf/pdf_store.c
@@ -238,7 +238,6 @@ pdf_storeitem(pdf_store *store, pdf_itemkind kind, fz_obj *key, void *val)
 	item->age = 0;
 	item->next = nil;
 
-
 	if (fz_isindirect(key))
 	{
 		struct refkey refkey;
@@ -307,24 +306,25 @@ pdf_removeitem(pdf_store *store, pdf_itemkind kind, fz_obj *key)
 	fz_error error;
 	pdf_item *item, *prev;
 	struct refkey refkey;
-	void *val;
 
 	if (key == nil)
 		return fz_okay;
 
-	val = nil;
-
 	if (fz_isindirect(key))
 	{
 		refkey.kind = kind;
 		refkey.oid = fz_tonum(key);
 		refkey.gen = fz_togen(key);
+
 		item = fz_hashfind(store->hash, &refkey);
-		if (item)
-			val = item->val;
+		if (!item)
+			return fz_throw("cannot remove non-existent item from store");
 		error = fz_hashremove(store->hash, &refkey);
 		if (error)
-			return error;
+			return fz_rethrow(error, "cannot remove item from store");
+		dropitem(kind, item->val);
+		fz_dropobj(item->key);
+		fz_free(item);
 	}
 
 	else
@@ -338,7 +338,8 @@ pdf_removeitem(pdf_store *store, pdf_itemkind kind, fz_obj *key)
 					store->root = item->next;
 				else
 					prev->next = item->next;
-				val = item->val;
+				dropitem(kind, item->val);
+				fz_dropobj(item->key);
 				fz_free(item);
 				break;
 			}
@@ -346,21 +347,6 @@ pdf_removeitem(pdf_store *store, pdf_itemkind kind, fz_obj *key)
 		}
 	}
 
-	if (val)
-	{
-		switch (kind)
-		{
-			case PDF_KCOLORSPACE: fz_dropcolorspace(val); break;
-			case PDF_KFUNCTION: pdf_dropfunction(val); break;
-			case PDF_KXOBJECT: pdf_dropxobject(val); break;
-			case PDF_KIMAGE: fz_dropimage(val); break;
-			case PDF_KPATTERN: pdf_droppattern(val); break;
-			case PDF_KSHADE: fz_dropshade(val); break;
-			case PDF_KCMAP: pdf_dropcmap(val); break;
-			case PDF_KFONT: pdf_dropfont(val); break;
-		}
-	}
-
 	return fz_okay;
 }
 
diff --git a/mupdf/pdf_stream.c b/mupdf/pdf_stream.c
index afb44ec5..86094bb8 100644
--- a/mupdf/pdf_stream.c
+++ b/mupdf/pdf_stream.c
@@ -328,13 +328,10 @@ pdf_buildfilter(fz_filter **filterp, pdf_xref *xref, fz_obj *stmobj, int oid, in
 		}
 		else
 		{
+			/* The pipeline chain takes ownership of base */
 			error = buildfilterchain(&pipe, xref, base, filters, params);
 			if (error)
-			{
-				fz_dropfilter(base);
 				return fz_rethrow(error, "cannot create filter chain");
-			}
-			fz_dropfilter(base);
 		}
 
 		*filterp = pipe;