diff options
| author | Robin Watts <robin.watts@artifex.com> | 2011-12-30 18:20:36 +0000 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2011-12-30 18:20:36 +0000 |
| commit | 7b7343ca4e0be9a5c97ab2ce433626ed2e7c107d (patch) | |
| tree | 9a38504654f217d470b008bde4edba3e2fefaa30 /xps | |
| parent | 1a389f151b95658edadd79441861cd9c65b00c51 (diff) | |
| download | mupdf-7b7343ca4e0be9a5c97ab2ce433626ed2e7c107d.tar.xz | |
Avoid SEGV when reading PNG from XPS
The xps png reading code was overwriting its context pointer with
zero, then referencing through it.
Diffstat (limited to 'xps')
| -rw-r--r-- | xps/xps_png.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/xps/xps_png.c b/xps/xps_png.c index 719e522f..4ed9f121 100644 --- a/xps/xps_png.c +++ b/xps/xps_png.c @@ -350,13 +350,14 @@ png_read_phys(struct info *info, unsigned char *p, int size) } static void -png_read_image(struct info *info, unsigned char *p, int total) +png_read_image(fz_context *ctx, struct info *info, unsigned char *p, int total) { int passw[7], passh[7], passofs[8]; int code, size; z_stream stm; memset(info, 0, sizeof (struct info)); + info->ctx = ctx; memset(info->palette, 255, sizeof(info->palette)); info->xres = 96; info->yres = 96; @@ -505,9 +506,7 @@ xps_decode_png(fz_context *ctx, byte *p, int total) struct info png; int stride; - png.ctx = ctx; - - png_read_image(&png, p, total); + png_read_image(ctx, &png, p, total); if (png.n == 3 || png.n == 4) colorspace = fz_device_rgb; |