Attachment 66862 Details for Bug 54090 – solves 1258.pdf.SIGSEGV.dee.288 and 1255.pdf.asan.38.285, extends 1043.pdf.asan.47.50 and 557.pdf.asan.47.894

[patch] solves 1258.pdf.SIGSEGV.dee.288 and 1255.pdf.asan.38.285, extends 1043.pdf.asan.47.50 and 557.pdf.asan.47.894

1258.pdf.SIGSEGV.dee.288.patch (text/plain), 2.07 KB, created by Thomas Freitag on 2012-09-09 05:28:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Freitag

Created: 2012-09-09 05:28:37 UTC

Size: 2.07 KB

patch

obsolete

>diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc
>index e3413e5..d384d5c 100644
>--- a/poppler/GfxState.cc
>+++ b/poppler/GfxState.cc
>@@ -2161,10 +2161,16 @@ GfxColorSpace *GfxSeparationColorSpace::parse(Array *arr, Gfx *gfx, int recursio
>   if (!(funcA = Function::parse(&obj1))) {
>     goto err4;
>   }
>+  if (funcA->getInputSize() != 1) {
>+    error(errSyntaxWarning, -1, "Bad SeparationColorSpace function");
>+    goto err5;
>+  }
>   obj1.free();
>   cs = new GfxSeparationColorSpace(nameA, altA, funcA);
>   return cs;
> 
>+ err5:
>+  delete funcA;
>  err4:
>   delete altA;
>  err3:
>@@ -3084,6 +3090,10 @@ void GfxUnivariateShading::getColor(double t, GfxColor *color) {
>       out[i] = 0;
>     }
>     for (i = 0; i < nFuncs; ++i) {
>+      if (funcs[i]->getInputSize() != 1) {
>+        error(errSyntaxWarning, -1, "Invalid shading function (input != 1)");
>+        break;
>+      }
>       funcs[i]->transform(&t, &out[i]);
>     }
>   }
>@@ -3255,7 +3265,7 @@ GfxAxialShading *GfxAxialShading::parse(Dict *dict, Gfx *gfx) {
>   dict->lookup("Function", &obj1);
>   if (obj1.isArray()) {
>     nFuncsA = obj1.arrayGetLength();
>-    if (nFuncsA > gfxColorMaxComps) {
>+    if (nFuncsA > gfxColorMaxComps || nFuncsA == 0) {
>       error(errSyntaxWarning, -1, "Invalid Function array in shading dictionary");
>       goto err1;
>     }
>@@ -3280,9 +3290,19 @@ GfxAxialShading *GfxAxialShading::parse(Dict *dict, Gfx *gfx) {
>   extend0A = extend1A = gFalse;
>   if (dict->lookup("Extend", &obj1)->isArray() &&
>       obj1.arrayGetLength() == 2) {
>-    extend0A = obj1.arrayGet(0, &obj2)->getBool();
>+    obj1.arrayGet(0, &obj2);
>+    if (obj2.isBool()) {
>+      extend0A = obj2.getBool();
>+    } else {
>+      error(errSyntaxWarning, -1, "Invalid axial shading extend (0)");
>+    }
>     obj2.free();
>-    extend1A = obj1.arrayGet(1, &obj2)->getBool();
>+    obj1.arrayGet(1, &obj2);
>+    if (obj2.isBool()) {
>+      extend1A = obj2.getBool();
>+    } else {
>+      error(errSyntaxWarning, -1, "Invalid axial shading extend (1)");
>+    }
>     obj2.free();
>   }
>   obj1.free();

Actions: View | Splinter Review

Attachments on bug 54090: 66142 | 66175 | 66176 | 66177 | 66178 | 66274 | 66275 | 66433 | 66434 | 66435 | 66436 | 66538 | 66577 | 66582 | 66586 | 66858 | 66859 | 66860 | 66861 | 66862 | 66868 | 66870 | 66871 | 66872

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.