diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2018-01-29 23:40:19 +0100 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2018-02-01 17:21:09 +0100 |
| commit | 3e30fbb7bf5efd88df431e366492356e7eb969ec (patch) | |
| tree | 2081dab26c94e38cc30252adb1abf320313b8740 /source/pdf | |
| parent | b03def134988da8c800adac1a38a41a1f09a1d89 (diff) | |
| download | mupdf-3e30fbb7bf5efd88df431e366492356e7eb969ec.tar.xz | |
Bug 698908: Resize object use and renumbering lists after repair.
Previously repair might end up increasing xref_len, but the lists
were not correspodingly expanded, leading to ASAN complaints.
Diffstat (limited to 'source/pdf')
| -rw-r--r-- | source/pdf/pdf-write.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/source/pdf/pdf-write.c b/source/pdf/pdf-write.c index a7326a17..bc67f003 100644 --- a/source/pdf/pdf-write.c +++ b/source/pdf/pdf-write.c @@ -634,7 +634,8 @@ expand_lists(fz_context *ctx, pdf_write_state *opts, int num) { int i; - num++; + /* objects are numbered 0..num and maybe two additional objects for linearization */ + num += 3; opts->use_list = fz_resize_array(ctx, opts->use_list, num, sizeof(*opts->use_list)); opts->ofs_list = fz_resize_array(ctx, opts->ofs_list, num, sizeof(*opts->ofs_list)); opts->gen_list = fz_resize_array(ctx, opts->gen_list, num, sizeof(*opts->gen_list)); @@ -1524,9 +1525,9 @@ static void preloadobjstms(fz_context *ctx, pdf_document *doc) { pdf_obj *obj; int num; - int xref_len = pdf_xref_len(ctx, doc); - for (num = 0; num < xref_len; num++) + /* xref_len may change due to repair, so check it every iteration */ + for (num = 0; num < pdf_xref_len(ctx, doc); num++) { if (pdf_get_xref_entry(ctx, doc, num)->type == 'o') { @@ -2772,7 +2773,7 @@ static void initialise_write_state(fz_context *ctx, pdf_document *doc, const pdf opts->continue_on_error = in_opts->continue_on_error; opts->errors = in_opts->errors; - expand_lists(ctx, opts, xref_len + 3); + expand_lists(ctx, opts, xref_len); } /* Free the resources held by the dynamic write options */ @@ -2926,8 +2927,9 @@ do_pdf_save_document(fz_context *ctx, pdf_document *doc, pdf_write_state *opts, { pdf_ensure_solid_xref(ctx, doc, xref_len); preloadobjstms(ctx, doc); - change_identity(ctx, doc); + xref_len = pdf_xref_len(ctx, doc); /* May have changed due to repair */ + expand_lists(ctx, opts, xref_len); } /* Sweep & mark objects from the trailer */ @@ -2936,6 +2938,7 @@ do_pdf_save_document(fz_context *ctx, pdf_document *doc, pdf_write_state *opts, else { xref_len = pdf_xref_len(ctx, doc); /* May have changed due to repair */ + expand_lists(ctx, opts, xref_len); for (num = 0; num < xref_len; num++) opts->use_list[num] = 1; } @@ -2964,6 +2967,7 @@ do_pdf_save_document(fz_context *ctx, pdf_document *doc, pdf_write_state *opts, if ((opts->do_garbage >= 2 || opts->do_linear) && !opts->do_incremental) { xref_len = pdf_xref_len(ctx, doc); /* May have changed due to repair */ + expand_lists(ctx, opts, xref_len); while (xref_len > 0 && !opts->use_list[xref_len-1]) xref_len--; } |