summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSebastian Rasmussen <sebras@gmail.com>2012-07-20 01:42:16 +0200
committerTor Andersson <tor.andersson@artifex.com>2012-07-24 11:29:30 +0200
commitbbd633a8819f4494e2b4fb10f177fc91bbf38e52 (patch)
tree29148fe0ab2f45799051db3747e24c71beb6f9a8
parentfcc84fdc6fdba24d1ce5fcbf4ae74c7228bb844e (diff)
downloadmupdf-bbd633a8819f4494e2b4fb10f177fc91bbf38e52.tar.xz
Handle out of range pdf subfunction boundaries
Any pdf function with incorrect number of subfunction boundaries will either cause an exception or have excessive boundaries be ignored.
-rw-r--r--pdf/pdf_function.c14
1 files changed, 7 insertions, 7 deletions
diff --git a/pdf/pdf_function.c b/pdf/pdf_function.c
index b561201e..4825afd4 100644
--- a/pdf/pdf_function.c
+++ b/pdf/pdf_function.c
@@ -1258,22 +1258,22 @@ load_stitching_func(pdf_function *func, pdf_document *xref, pdf_obj *dict)
if (!pdf_is_array(obj))
fz_throw(ctx, "stitching function has no bounds");
{
- if (pdf_array_len(obj) != k - 1)
- fz_throw(ctx, "malformed /Bounds (wrong length)");
+ if (pdf_array_len(obj) < k - 1)
+ fz_throw(ctx, "too few subfunction boundaries");
+ if (pdf_array_len(obj) > k)
+ fz_warn(ctx, "too many subfunction boundaries");
for (i = 0; i < k - 1; i++)
{
num = pdf_array_get(obj, i);
- if (!pdf_is_int(num) && !pdf_is_real(num))
- fz_throw(ctx, "malformed /Bounds (item not real)");
func->u.st.bounds[i] = pdf_to_real(num);
if (i && func->u.st.bounds[i - 1] > func->u.st.bounds[i])
- fz_throw(ctx, "malformed /Bounds (item not monotonic)");
+ fz_throw(ctx, "subfunction %d boundary out of range", i);
}
- if (k != 1 && (func->domain[0][0] > func->u.st.bounds[0] ||
+ if (k > 1 && (func->domain[0][0] > func->u.st.bounds[0] ||
func->domain[0][1] < func->u.st.bounds[k - 2]))
- fz_warn(ctx, "malformed shading function bounds (domain mismatch), proceeding anyway.");
+ fz_warn(ctx, "subfunction boundaries outside of input mapping");
}
for (i = 0; i < k; i++)