71ac78f
From 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 Mon Sep 17 00:00:00 2001
71ac78f
From: Robin Watts <robin.watts@artifex.com>
71ac78f
Date: Thu, 9 Feb 2017 15:49:15 +0000
71ac78f
Subject: [PATCH 2/2] Bug 697500: Fix NULL ptr access.
71ac78f
71ac78f
Cope better with errors during rendering - avoid letting the
71ac78f
gstate stack get out of sync.
71ac78f
71ac78f
This avoids us ever getting into the situation of popping
71ac78f
a clip when we should be popping a mask or a group. This was
71ac78f
causing an unexpected case in the painting.
71ac78f
---
71ac78f
 source/pdf/pdf-op-run.c | 26 ++++++++++++++++++--------
71ac78f
 1 file changed, 18 insertions(+), 8 deletions(-)
71ac78f
71ac78f
diff --git a/source/pdf/pdf-op-run.c b/source/pdf/pdf-op-run.c
71ac78f
index a3ea895..f1eac8d 100644
71ac78f
--- a/source/pdf/pdf-op-run.c
71ac78f
+++ b/source/pdf/pdf-op-run.c
71ac78f
@@ -1213,6 +1213,7 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
71ac78f
 	pdf_run_processor *pr = (pdf_run_processor *)proc;
71ac78f
 	pdf_gstate *gstate = NULL;
71ac78f
 	int oldtop = 0;
71ac78f
+	int oldbot = -1;
71ac78f
 	fz_matrix local_transform = *transform;
71ac78f
 	softmask_save softmask = { NULL };
71ac78f
 	int gparent_save;
71ac78f
@@ -1232,16 +1233,17 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
71ac78f
 	fz_var(cleanup_state);
71ac78f
 	fz_var(gstate);
71ac78f
 	fz_var(oldtop);
71ac78f
+	fz_var(oldbot);
71ac78f
 
71ac78f
 	gparent_save = pr->gparent;
71ac78f
 	pr->gparent = pr->gtop;
71ac78f
+	oldtop = pr->gtop;
71ac78f
 
71ac78f
 	fz_try(ctx)
71ac78f
 	{
71ac78f
 		pdf_gsave(ctx, pr);
71ac78f
 
71ac78f
 		gstate = pr->gstate + pr->gtop;
71ac78f
-		oldtop = pr->gtop;
71ac78f
 
71ac78f
 		pdf_xobject_bbox(ctx, xobj, &xobj_bbox);
71ac78f
 		pdf_xobject_matrix(ctx, xobj, &xobj_matrix);
71ac78f
@@ -1302,12 +1304,25 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
71ac78f
 
71ac78f
 		doc = pdf_get_bound_document(ctx, xobj->obj);
71ac78f
 
71ac78f
+		oldbot = pr->gbot;
71ac78f
+		pr->gbot = pr->gtop;
71ac78f
+
71ac78f
 		pdf_process_contents(ctx, (pdf_processor*)pr, doc, resources, xobj->obj, NULL);
71ac78f
 	}
71ac78f
 	fz_always(ctx)
71ac78f
 	{
71ac78f
+		/* Undo any gstate mismatches due to the pdf_process_contents call */
71ac78f
+		if (oldbot != -1)
71ac78f
+		{
71ac78f
+			while (pr->gtop > pr->gbot)
71ac78f
+			{
71ac78f
+				pdf_grestore(ctx, pr);
71ac78f
+			}
71ac78f
+			pr->gbot = oldbot;
71ac78f
+		}
71ac78f
+
71ac78f
 		if (cleanup_state >= 3)
71ac78f
-			pdf_grestore(ctx, pr); /* Remove the clippath */
71ac78f
+			pdf_grestore(ctx, pr); /* Remove the state we pushed for the clippath */
71ac78f
 
71ac78f
 		/* wrap up transparency stacks */
71ac78f
 		if (transparency)
71ac78f
@@ -1341,13 +1356,8 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
71ac78f
 		pr->gstate[pr->gparent].ctm = gparent_save_ctm;
71ac78f
 		pr->gparent = gparent_save;
71ac78f
 
71ac78f
-		if (gstate)
71ac78f
-		{
71ac78f
-			while (oldtop < pr->gtop)
71ac78f
-				pdf_grestore(ctx, pr);
71ac78f
-
71ac78f
+		while (oldtop < pr->gtop)
71ac78f
 			pdf_grestore(ctx, pr);
71ac78f
-		}
71ac78f
 
71ac78f
 		pdf_unmark_obj(ctx, xobj->obj);
71ac78f
 	}
71ac78f
-- 
71ac78f
2.9.3
71ac78f