diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2012-07-20 01:42:16 +0200 |
|---|---|---|
| committer | Tor Andersson <tor.andersson@artifex.com> | 2012-07-24 11:29:30 +0200 |
| commit | bbd633a8819f4494e2b4fb10f177fc91bbf38e52 (patch) | |
| tree | 29148fe0ab2f45799051db3747e24c71beb6f9a8 /pdf/pdf_function.c | |
| parent | fcc84fdc6fdba24d1ce5fcbf4ae74c7228bb844e (diff) | |
| download | mupdf-bbd633a8819f4494e2b4fb10f177fc91bbf38e52.tar.xz | |
Handle out of range pdf subfunction boundaries
Any pdf function with incorrect number of subfunction boundaries
will either cause an exception or have excessive boundaries be
ignored.
Diffstat (limited to 'pdf/pdf_function.c')
| -rw-r--r-- | pdf/pdf_function.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/pdf/pdf_function.c b/pdf/pdf_function.c index b561201e..4825afd4 100644 --- a/pdf/pdf_function.c +++ b/pdf/pdf_function.c @@ -1258,22 +1258,22 @@ load_stitching_func(pdf_function *func, pdf_document *xref, pdf_obj *dict) if (!pdf_is_array(obj)) fz_throw(ctx, "stitching function has no bounds"); { - if (pdf_array_len(obj) != k - 1) - fz_throw(ctx, "malformed /Bounds (wrong length)"); + if (pdf_array_len(obj) < k - 1) + fz_throw(ctx, "too few subfunction boundaries"); + if (pdf_array_len(obj) > k) + fz_warn(ctx, "too many subfunction boundaries"); for (i = 0; i < k - 1; i++) { num = pdf_array_get(obj, i); - if (!pdf_is_int(num) && !pdf_is_real(num)) - fz_throw(ctx, "malformed /Bounds (item not real)"); func->u.st.bounds[i] = pdf_to_real(num); if (i && func->u.st.bounds[i - 1] > func->u.st.bounds[i]) - fz_throw(ctx, "malformed /Bounds (item not monotonic)"); + fz_throw(ctx, "subfunction %d boundary out of range", i); } - if (k != 1 && (func->domain[0][0] > func->u.st.bounds[0] || + if (k > 1 && (func->domain[0][0] > func->u.st.bounds[0] || func->domain[0][1] < func->u.st.bounds[k - 2])) - fz_warn(ctx, "malformed shading function bounds (domain mismatch), proceeding anyway."); + fz_warn(ctx, "subfunction boundaries outside of input mapping"); } for (i = 0; i < k; i++) |