Various patches from SumatraPDF.

5 files changed, 26 insertions, 7 deletions

diff --git a/fitz/base_memory.c b/fitz/base_memory.c
index b7ebb2c9..caeee451 100644
--- a/fitz/base_memory.c
+++ b/fitz/base_memory.c
@@ -1,7 +1,5 @@
 #include "fitz.h"
 
-#define INT_MAX 2147483647
-
 void *
 fz_malloc(int size)
 {
@@ -22,7 +20,7 @@ fz_calloc(int count, int size)
 	if (count == 0 || size == 0)
 		return 0;
 
-	if (count > INT_MAX / size)
+	if (count < 0 || size < 0 || count > INT_MAX / size)
 	{
 		fprintf(stderr, "fatal error: out of memory (integer overflow)\n");
 		abort();
@@ -43,9 +41,12 @@ fz_realloc(void *p, int count, int size)
 	void *np;
 
 	if (count == 0 || size == 0)
-		return p;
+	{
+		fz_free(p);
+		return 0;
+	}
 
-	if (count > INT_MAX / size)
+	if (count < 0 || size < 0 || count > INT_MAX / size)
 	{
 		fprintf(stderr, "fatal error: out of memory (integer overflow)\n");
 		abort();
diff --git a/fitz/dev_text.c b/fitz/dev_text.c
index 806fa40c..8f22cfd1 100644
--- a/fitz/dev_text.c
+++ b/fitz/dev_text.c
@@ -98,7 +98,7 @@ fz_addtextchar(fz_textspan **last, fz_font *font, float size, int wmode, int c,
 		span->size = size;
 	}
 
-	if (span->font != font || span->size != size || span->wmode != wmode)
+	if ((span->font != font || span->size != size || span->wmode != wmode) && c != 32)
 	{
 		span = fz_newtextspan();
 		span->font = fz_keepfont(font);
diff --git a/fitz/filt_flate.c b/fitz/filt_flate.c
index e021b8fe..acda8c49 100644
--- a/fitz/filt_flate.c
+++ b/fitz/filt_flate.c
@@ -12,7 +12,7 @@ struct fz_flate_s
 
 static void *zmalloc(void *opaque, unsigned int items, unsigned int size)
 {
-	return fz_malloc(items * size);
+	return fz_calloc(items, size);
 }
 
 static void zfree(void *opaque, void *ptr)
diff --git a/fitz/fitz.h b/fitz/fitz.h
index b7787acc..4032bddf 100644
--- a/fitz/fitz.h
+++ b/fitz/fitz.h
@@ -14,6 +14,7 @@
 
 #include <assert.h>
 #include <errno.h>
+#include <limits.h>	/* INT_MAX & co */
 #include <float.h>	/* FLT_EPSILON */
 #include <fcntl.h>	/* O_RDONLY & co */
 
@@ -427,6 +428,7 @@ int fz_arraylen(fz_obj *array);
 fz_obj *fz_arrayget(fz_obj *array, int i);
 void fz_arrayput(fz_obj *array, int i, fz_obj *obj);
 void fz_arraypush(fz_obj *array, fz_obj *obj);
+void fz_arraydrop(fz_obj *array);
 void fz_arrayinsert(fz_obj *array, fz_obj *obj);
 
 int fz_dictlen(fz_obj *dict);
diff --git a/fitz/obj_array.c b/fitz/obj_array.c
index 8e94119f..391c1dd8 100644
--- a/fitz/obj_array.c
+++ b/fitz/obj_array.c
@@ -101,6 +101,22 @@ fz_arraypush(fz_obj *obj, fz_obj *item)
 }
 
 void
+fz_arraydrop(fz_obj *obj)
+{
+	obj = fz_resolveindirect(obj);
+
+	if (!fz_isarray(obj))
+		fz_warn("assert: not an array (%s)", fz_objkindstr(obj));
+	else
+	{
+		if (obj->u.a.len > 0)
+		{
+			fz_dropobj(obj->u.a.items[--obj->u.a.len]);
+		}
+	}
+}
+
+void
 fz_arrayinsert(fz_obj *obj, fz_obj *item)
 {
 	obj = fz_resolveindirect(obj);