Protect against draw device stack confusion due to errors while pushing.

Whenever we have an error while pushing a gstate, we run the risk of
getting confused over how many pops we need etc.

With this commit we introduce some checking at the dev_null level that
attempts to make this behaviour consistent.

Any caller may now assume that calling an operation that pushes a clip
will always succeed. This means the only error cleanup they need to
do is to ensure that if they have pushed a clip (or begun a group, or
a mask etc) is to pop it too.

Any callee may now assume that if it throws an error during the call
to a device entrypoint that would create a group/clip/mask then no more
calls will be forthcoming until after the caller has completely finished
with that group.

This is achieved by the dev_null layer (the layer that indirects from
device calls through the device structure to the function pointers)
swallowing errors and regurgitating them later as required. A count is
kept of the number of pushes that have happened since an error
occurred during a push (including that initial one). When this count
reaches zero, the original error is regurgitated. This allows the
caller to keep the cookie correctly updated.

1 files changed, 3 insertions, 0 deletions

diff --git a/fitz/fitz-internal.h b/fitz/fitz-internal.h
index 0de2e4c2..35b20d71 100644
--- a/fitz/fitz-internal.h
+++ b/fitz/fitz-internal.h
@@ -1396,6 +1396,9 @@ struct fz_device_s
 
 	void (*begin_tile)(fz_device *, fz_rect area, fz_rect view, float xstep, float ystep, fz_matrix ctm);
 	void (*end_tile)(fz_device *);
+
+	int error_depth;
+	char errmess[256];
 };
 
 void fz_fill_path(fz_device *dev, fz_path *path, int even_odd, fz_matrix ctm, fz_colorspace *colorspace, float *color, float alpha);