diff options
author | Robin Watts <robin.watts@artifex.com> | 2012-01-13 17:58:19 +0000 |
---|---|---|
committer | Robin Watts <robin.watts@artifex.com> | 2012-01-13 17:58:19 +0000 |
commit | b0dd445c76ec8d36648c9f8c9c10b738e963908e (patch) | |
tree | 66d06f41ea6887e554223cd96a0cb00128cfdd20 /pdf/pdf_xobject.c | |
parent | b203c82007a8f5e321e2e2b74b8b3ee58a425ba5 (diff) | |
download | mupdf-b0dd445c76ec8d36648c9f8c9c10b738e963908e.tar.xz |
Avoid infinite loops with XObjects.
Every xobject keeps a reference to the object from whence
it came. This is marked/unmarked as it is executed.
Thanks to Zeniko for spotting the potential problem.
Diffstat (limited to 'pdf/pdf_xobject.c')
-rw-r--r-- | pdf/pdf_xobject.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/pdf/pdf_xobject.c b/pdf/pdf_xobject.c index b56996cd..61daf9a4 100644 --- a/pdf/pdf_xobject.c +++ b/pdf/pdf_xobject.c @@ -24,6 +24,7 @@ pdf_free_xobject_imp(fz_context *ctx, fz_storable *xobj_) fz_drop_obj(xobj->resources); if (xobj->contents) fz_drop_buffer(ctx, xobj->contents); + fz_drop_obj(xobj->me); fz_free(ctx, xobj); } @@ -52,6 +53,7 @@ pdf_load_xobject(pdf_xref *xref, fz_obj *dict) form->resources = NULL; form->contents = NULL; form->colorspace = NULL; + form->me = NULL; /* Store item immediately, to avoid possible recursion if objects refer back to this one */ fz_store_item(ctx, dict, form, pdf_xobject_size(form)); @@ -104,6 +106,7 @@ pdf_load_xobject(pdf_xref *xref, fz_obj *dict) pdf_drop_xobject(ctx, form); fz_throw(ctx, "cannot load xobject content stream (%d %d R)", fz_to_num(dict), fz_to_gen(dict)); } + form->me = fz_keep_obj(dict); return form; } |