diff options
author | Tor Andersson <tor.andersson@artifex.com> | 2012-07-24 11:29:12 +0200 |
---|---|---|
committer | Tor Andersson <tor.andersson@artifex.com> | 2012-07-24 11:29:12 +0200 |
commit | fcc84fdc6fdba24d1ce5fcbf4ae74c7228bb844e (patch) | |
tree | cbece77a2a82307dca118ed26aa7fcb01fef4b13 /pdf/pdf_function.c | |
parent | c2f34a9605cbd3f59fa2a02ffdbd1d655e11cd42 (diff) | |
download | mupdf-fcc84fdc6fdba24d1ce5fcbf4ae74c7228bb844e.tar.xz |
Handle exponential pdf functions with malformed constants
Any pdf functions with incorrect number of constants will have their
constant values set to default values. Any excessive constants are
ignored.
Diffstat (limited to 'pdf/pdf_function.c')
-rw-r--r-- | pdf/pdf_function.c | 34 |
1 files changed, 16 insertions, 18 deletions
diff --git a/pdf/pdf_function.c b/pdf/pdf_function.c index 005572df..b561201e 100644 --- a/pdf/pdf_function.c +++ b/pdf/pdf_function.c @@ -1156,35 +1156,33 @@ load_exponential_func(fz_context *ctx, pdf_function *func, pdf_obj *dict) fz_warn(ctx, "exponential function input domain includes illegal input value zero"); } + for (i = 0; i < func->n; i++) + { + func->u.e.c0[i] = 0; + func->u.e.c1[i] = 1; + } + obj = pdf_dict_gets(dict, "C0"); if (pdf_is_array(obj)) { - func->n = pdf_array_len(obj); - if (func->n >= MAXN) - fz_throw(ctx, "exponential function result array out of range"); - for (i = 0; i < func->n; i++) + int ranges = fz_mini(func->n, pdf_array_len(obj)); + if (ranges != func->n) + fz_warn(ctx, "too few/many C0 constants for exponential function"); + + for (i = 0; i < ranges; i++) func->u.e.c0[i] = pdf_to_real(pdf_array_get(obj, i)); } - else - { - func->n = 1; - func->u.e.c0[0] = 0; - } obj = pdf_dict_gets(dict, "C1"); if (pdf_is_array(obj)) { - if (pdf_array_len(obj) != func->n) - fz_throw(ctx, "/C1 must match /C0 length"); - for (i = 0; i < func->n; i++) + int ranges = fz_mini(func->n, pdf_array_len(obj)); + if (ranges != func->n) + fz_warn(ctx, "too few/many C1 constants for exponential function"); + + for (i = 0; i < ranges; i++) func->u.e.c1[i] = pdf_to_real(pdf_array_get(obj, i)); } - else - { - if (func->n != 1) - fz_throw(ctx, "/C1 must match /C0 length"); - func->u.e.c1[0] = 1; - } } static void |