From 26527eef77b3e51c2258c8e40845bfbc015e405d Mon Sep 17 00:00:00 2001 From: Sebastian Rasmussen Date: Mon, 29 Jan 2018 02:00:48 +0100 Subject: Bug 698830: Don't drop unkept stream if running out of error stack. Under normal conditions where fz_keep_stream() is called inside fz_try() we may call fz_drop_stream() in fz_catch() upon exceptions. The issue comes when fz_keep_stream() has not yet been called but is dropped in fz_catch(). This happens in the PDF from the bug when fz_try() runs out of exception stack, and next the code in fz_catch() runs, dropping the caller's reference to the filter chain stream! The simplest way of fixing this it to always keep the filter chain stream before fz_try() is called. That way fz_catch() may drop the stream whether an exception has occurred or if the fz_try() ran out of exception stack. --- source/pdf/pdf-stream.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'source/pdf') diff --git a/source/pdf/pdf-stream.c b/source/pdf/pdf-stream.c index c89da5c4..c6ba7ad3 100644 --- a/source/pdf/pdf-stream.c +++ b/source/pdf/pdf-stream.c @@ -303,14 +303,13 @@ pdf_open_raw_filter(fz_context *ctx, fz_stream *chain, pdf_document *doc, pdf_ob *orig_gen = 0; } - fz_var(chain); + chain = fz_keep_stream(ctx, chain); fz_try(ctx) { len = pdf_to_int(ctx, pdf_dict_get(ctx, stmobj, PDF_NAME_Length)); - /* don't close chain when we close this filter */ - chain2 = fz_keep_stream(ctx, chain); + chain2 = chain; chain = NULL; chain = fz_open_null(ctx, chain2, len, offset); -- cgit v1.2.3