Bug 695892: Fix incremental updates of documents with xref streams.

Simon Reinhardt points out that writexrefstream calls pdf_update_stream
on an object, rather than on a reference. The code as written fails to
do the update, and the updated file is broken.

I fix this here by updating pdf_update_stream to be able to work
with both objects and references. This is in contrast to his patch
which would create a reference for the sole purpose of performing
the update.

1 files changed, 9 insertions, 5 deletions

diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index 0524376c..24ee3716 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -2126,11 +2126,15 @@ pdf_update_object(fz_context *ctx, pdf_document *doc, int num, pdf_obj *newobj)
 }
 
 void
-pdf_update_stream(fz_context *ctx, pdf_document *doc, pdf_obj *ref, fz_buffer *newbuf, int compressed)
+pdf_update_stream(fz_context *ctx, pdf_document *doc, pdf_obj *obj, fz_buffer *newbuf, int compressed)
 {
-	int num = pdf_to_num(ctx, ref);
+	int num;
 	pdf_xref_entry *x;
 
+	if (pdf_is_indirect(ctx, obj))
+		num = pdf_to_num(ctx, obj);
+	else
+		num = pdf_obj_parent_num(ctx, obj);
 	if (num <= 0 || num >= pdf_xref_len(ctx, doc))
 	{
 		fz_warn(ctx, "object out of range (%d 0 R); xref size %d", num, pdf_xref_len(ctx, doc));
@@ -2142,11 +2146,11 @@ pdf_update_stream(fz_context *ctx, pdf_document *doc, pdf_obj *ref, fz_buffer *n
 	fz_drop_buffer(ctx, x->stm_buf);
 	x->stm_buf = fz_keep_buffer(ctx, newbuf);
 
-	pdf_dict_puts_drop(ctx, ref, "Length", pdf_new_int(ctx, doc, newbuf->len));
+	pdf_dict_puts_drop(ctx, obj, "Length", pdf_new_int(ctx, doc, newbuf->len));
 	if (!compressed)
 	{
-		pdf_dict_dels(ctx, ref, "Filter");
-		pdf_dict_dels(ctx, ref, "DecodeParms");
+		pdf_dict_dels(ctx, obj, "Filter");
+		pdf_dict_dels(ctx, obj, "DecodeParms");
 	}
 }