Make in_array state a local variable to cope with broken XObject streams.

2 files changed, 14 insertions, 24 deletions

diff --git a/pdf/pdf_interpret.c b/pdf/pdf_interpret.c
index 827678e5..3321e824 100644
--- a/pdf/pdf_interpret.c
+++ b/pdf/pdf_interpret.c
@@ -79,7 +79,6 @@ struct pdf_csi_s
 
 	int xbalance;
 	int in_text;
-	int in_array;
 
 	/* path object state */
 	fz_path *path;
@@ -670,7 +669,6 @@ pdf_new_csi(pdf_xref *xref, fz_device *dev, fz_matrix ctm, char *target)
 
 	csi->xbalance = 0;
 	csi->in_text = 0;
-	csi->in_array = 0;
 
 	csi->path = fz_new_path();
 
@@ -2114,17 +2112,11 @@ static fz_error
 pdf_run_stream(pdf_csi *csi, fz_obj *rdb, fz_stream *file, char *buf, int buflen)
 {
 	fz_error error;
-	int tok;
-	int len;
-	int save_in_array;
-	int save_in_text;
+	int tok, len, in_array;
 
 	/* make sure we have a clean slate if we come here from flush_text */
 	pdf_clear_stack(csi);
-	save_in_array = csi->in_array;
-	save_in_text = csi->in_text;
-	csi->in_array = 0;
-	csi->in_text = 0;
+	in_array = 0;
 
 	while (1)
 	{
@@ -2135,11 +2127,11 @@ pdf_run_stream(pdf_csi *csi, fz_obj *rdb, fz_stream *file, char *buf, int buflen
 		if (error)
 			return fz_rethrow(error, "lexical error in content stream");
 
-		if (csi->in_array)
+		if (in_array)
 		{
 			if (tok == PDF_TOK_CLOSE_ARRAY)
 			{
-				csi->in_array = 0;
+				in_array = 0;
 			}
 			else if (tok == PDF_TOK_INT || tok == PDF_TOK_REAL)
 			{
@@ -2158,7 +2150,7 @@ pdf_run_stream(pdf_csi *csi, fz_obj *rdb, fz_stream *file, char *buf, int buflen
 					return fz_throw("syntax error in array");
 			}
 			else if (tok == PDF_TOK_EOF)
-				goto end;
+				return fz_okay;
 			else
 				return fz_throw("syntax error in array");
 		}
@@ -2167,7 +2159,7 @@ pdf_run_stream(pdf_csi *csi, fz_obj *rdb, fz_stream *file, char *buf, int buflen
 		{
 		case PDF_TOK_ENDSTREAM:
 		case PDF_TOK_EOF:
-			goto end;
+			return fz_okay;
 
 		case PDF_TOK_OPEN_ARRAY:
 			if (!csi->in_text)
@@ -2178,7 +2170,7 @@ pdf_run_stream(pdf_csi *csi, fz_obj *rdb, fz_stream *file, char *buf, int buflen
 			}
 			else
 			{
-				csi->in_array = 1;
+				in_array = 1;
 			}
 			break;
 
@@ -2225,11 +2217,6 @@ pdf_run_stream(pdf_csi *csi, fz_obj *rdb, fz_stream *file, char *buf, int buflen
 			return fz_throw("syntax error in content stream");
 		}
 	}
-
-end:
-	csi->in_array = save_in_array;
-	csi->in_text = save_in_text;
-	return fz_okay;
 }
 
 /*
@@ -2243,7 +2230,10 @@ pdf_run_buffer(pdf_csi *csi, fz_obj *rdb, fz_buffer *contents)
 	int len = sizeof csi->xref->scratch;
 	char *buf = fz_malloc(len); /* we must be re-entrant for type3 fonts */
 	fz_stream *file = fz_open_buffer(contents);
+	int save_in_text = csi->in_text;
+	csi->in_text = 0;
 	error = pdf_run_stream(csi, rdb, file, buf, len);
+	csi->in_text = save_in_text;
 	fz_close(file);
 	fz_free(buf);
 	if (error)
diff --git a/pdf/pdf_repair.c b/pdf/pdf_repair.c
index 141cc361..067fe2cf 100644
--- a/pdf/pdf_repair.c
+++ b/pdf/pdf_repair.c
@@ -258,7 +258,7 @@ pdf_repair_xref(pdf_xref *xref, char *buf, int bufsize)
 			gen = atoi(buf);
 		}
 
-		if (tok == PDF_TOK_OBJ)
+		else if (tok == PDF_TOK_OBJ)
 		{
 			error = pdf_repair_obj(xref->file, buf, bufsize, &stm_ofs, &stm_len, &encrypt, &id);
 			if (error)
@@ -285,7 +285,7 @@ pdf_repair_xref(pdf_xref *xref, char *buf, int bufsize)
 		}
 
 		/* trailer dictionary */
-		if (tok == PDF_TOK_OPEN_DICT)
+		else if (tok == PDF_TOK_OPEN_DICT)
 		{
 			error = pdf_parse_dict(&dict, xref, xref->file, buf, bufsize);
 			if (error)
@@ -329,10 +329,10 @@ pdf_repair_xref(pdf_xref *xref, char *buf, int bufsize)
 			fz_drop_obj(dict);
 		}
 
-		if (tok == PDF_TOK_ERROR)
+		else if (tok == PDF_TOK_ERROR)
 			fz_read_byte(xref->file);
 
-		if (tok == PDF_TOK_EOF)
+		else if (tok == PDF_TOK_EOF)
 			break;
 	}