diff options
| -rw-r--r-- | mupdf/pdf_annot.c | 6 | ||||
| -rw-r--r-- | mupdf/pdf_font.c | 14 | ||||
| -rw-r--r-- | mupdf/pdf_interpret.c | 10 | ||||
| -rw-r--r-- | mupdf/pdf_type3.c | 2 |
4 files changed, 21 insertions, 11 deletions
diff --git a/mupdf/pdf_annot.c b/mupdf/pdf_annot.c index c29908b6..f98e0323 100644 --- a/mupdf/pdf_annot.c +++ b/mupdf/pdf_annot.c @@ -103,12 +103,12 @@ pdf_loadlink(pdf_link **linkp, pdf_xref *xref, fz_obj *dict) if (action) { obj = fz_dictgets(action, "S"); - if (!strcmp(fz_toname(obj), "GoTo")) + if (fz_isname(obj) && !strcmp(fz_toname(obj), "GoTo")) { dest = resolvedest(xref, fz_dictgets(action, "D")); pdf_logpage("action goto (%d %d R)\n", fz_tonum(dest), fz_togen(dest)); } - else if (!strcmp(fz_toname(obj), "URI")) + else if (fz_isname(obj) && !strcmp(fz_toname(obj), "URI")) { dest = fz_dictgets(action, "URI"); pdf_logpage("action uri %s\n", fz_tostrbuf(dest)); @@ -150,7 +150,7 @@ pdf_loadannots(pdf_comment **cp, pdf_link **lp, pdf_xref *xref, fz_obj *annots) obj = fz_arrayget(annots, i); subtype = fz_dictgets(obj, "Subtype"); - if (!strcmp(fz_toname(subtype), "Link")) + if (fz_isname(subtype) && !strcmp(fz_toname(subtype), "Link")) { pdf_link *temp = nil; diff --git a/mupdf/pdf_font.c b/mupdf/pdf_font.c index 7ed646bb..39ccd512 100644 --- a/mupdf/pdf_font.c +++ b/mupdf/pdf_font.c @@ -824,9 +824,9 @@ loadtype0(pdf_fontdesc **fontdescp, pdf_xref *xref, fz_obj *dict, fz_obj *ref) encoding = fz_dictgets(dict, "Encoding"); tounicode = fz_dictgets(dict, "ToUnicode"); - if (!strcmp(fz_toname(subtype), "CIDFontType0")) + if (fz_isname(subtype) && !strcmp(fz_toname(subtype), "CIDFontType0")) error = loadcidfont(fontdescp, xref, dfont, ref, encoding, tounicode); - else if (!strcmp(fz_toname(subtype), "CIDFontType2")) + else if (fz_isname(subtype) && !strcmp(fz_toname(subtype), "CIDFontType2")) error = loadcidfont(fontdescp, xref, dfont, ref, encoding, tounicode); else error = fz_throw("syntaxerror: unknown cid font type"); @@ -914,13 +914,15 @@ pdf_loadfont(pdf_fontdesc **fontdescp, pdf_xref *xref, fz_obj *dict, fz_obj *ref } subtype = fz_toname(fz_dictgets(dict, "Subtype")); - if (!strcmp(subtype, "Type0")) + if (subtype && !strcmp(subtype, "Type0")) error = loadtype0(fontdescp, xref, dict, ref); - else if (!strcmp(subtype, "Type1") || !strcmp(subtype, "MMType1")) + else if (subtype && !strcmp(subtype, "Type1")) error = loadsimplefont(fontdescp, xref, dict, ref); - else if (!strcmp(subtype, "TrueType")) + else if (subtype && !strcmp(subtype, "MMType1")) error = loadsimplefont(fontdescp, xref, dict, ref); - else if (!strcmp(subtype, "Type3")) + else if (subtype && !strcmp(subtype, "TrueType")) + error = loadsimplefont(fontdescp, xref, dict, ref); + else if (subtype && !strcmp(subtype, "Type3")) error = pdf_loadtype3font(fontdescp, xref, dict, ref); else { diff --git a/mupdf/pdf_interpret.c b/mupdf/pdf_interpret.c index 3c9cb133..26d85c72 100644 --- a/mupdf/pdf_interpret.c +++ b/mupdf/pdf_interpret.c @@ -280,6 +280,8 @@ runextgstate(pdf_gstate *gstate, pdf_xref *xref, fz_obj *extgstate) fz_obj *key = fz_dictgetkey(extgstate, i); fz_obj *val = fz_dictgetval(extgstate, i); char *s = fz_toname(key); + if (!s) + fz_throw("malformed /ExtGState dictionary"); if (!strcmp(s, "Font")) { @@ -291,7 +293,7 @@ runextgstate(pdf_gstate *gstate, pdf_xref *xref, fz_obj *extgstate) gstate->size = fz_toreal(fz_arrayget(val, 1)); } else - return fz_throw("malformed /Font"); + return fz_throw("malformed /Font dictionary"); } else if (!strcmp(s, "LW")) @@ -343,7 +345,10 @@ runextgstate(pdf_gstate *gstate, pdf_xref *xref, fz_obj *extgstate) { "Color", FZ_BCOLOR }, { "Luminosity", FZ_BLUMINOSITY } }; + char *n = fz_toname(val); + if (!fz_isname(val)) + return fz_throw("malformed BM"); gstate->blendmode = FZ_BNORMAL; for (k = 0; k < nelem(bm); k++) { @@ -570,6 +575,9 @@ Lsetcolorspace: obj = csi->stack[0]; + if (!fz_isname(obj)) + return fz_throw("malformed CS"); + if (!strcmp(fz_toname(obj), "Pattern")) { error = pdf_setpattern(csi, what, nil, nil); diff --git a/mupdf/pdf_type3.c b/mupdf/pdf_type3.c index 1416a0d9..040a02be 100644 --- a/mupdf/pdf_type3.c +++ b/mupdf/pdf_type3.c @@ -53,7 +53,7 @@ pdf_loadtype3font(pdf_fontdesc **fontdescp, pdf_xref *xref, fz_obj *dict, fz_obj fz_matrix matrix; obj = fz_dictgets(dict, "Name"); - if (obj) + if (fz_isname(obj)) strlcpy(buf, fz_toname(obj), sizeof buf); else sprintf(buf, "Unnamed-T3"); |