poppler/Gfx.cc | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-)
New commits: commit 307d6db4247e3b934b5d26059fcd217517c4a187 Author: Albert Astals Cid <aa...@kde.org> Date: Sat Aug 22 20:01:09 2020 +0200 Gfx::opSetExtGState: Fix memory leak on broken files While at it move definitions of i and funcs down where used, also remove the abuse of funcs[0] in one place and just declare a Function for it diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc index dff71ed2..04b81e65 100644 --- a/poppler/Gfx.cc +++ b/poppler/Gfx.cc @@ -932,12 +932,10 @@ void Gfx::opSetExtGState(Object args[], int numArgs) Object obj1, obj2; GfxBlendMode mode; bool haveFillOP; - Function *funcs[4]; GfxColor backdropColor; bool haveBackdropColor; bool alpha; double opac; - int i; obj1 = res->lookupGState(args[0].getName()); if (obj1.isNull()) { @@ -1055,22 +1053,28 @@ void Gfx::opSetExtGState(Object args[], int numArgs) obj2 = obj1.dictLookup("TR"); } if (obj2.isName("Default") || obj2.isName("Identity")) { - funcs[0] = funcs[1] = funcs[2] = funcs[3] = nullptr; + Function *funcs[4] = { nullptr, nullptr, nullptr, nullptr }; state->setTransfer(funcs); out->updateTransfer(state); } else if (obj2.isArray() && obj2.arrayGetLength() == 4) { - for (i = 0; i < 4; ++i) { + Function *funcs[4] = { nullptr, nullptr, nullptr, nullptr }; + for (int i = 0; i < 4; ++i) { Object obj3 = obj2.arrayGet(i); funcs[i] = Function::parse(&obj3); if (!funcs[i]) { break; } } - if (i == 4) { + if (funcs[0] && funcs[1] && funcs[2] && funcs[3]) { state->setTransfer(funcs); out->updateTransfer(state); + } else { + for (Function *f : funcs) { + delete f; + } } } else if (obj2.isName() || obj2.isDict() || obj2.isStream()) { + Function *funcs[4]; if ((funcs[0] = Function::parse(&obj2))) { funcs[1] = funcs[2] = funcs[3] = nullptr; state->setTransfer(funcs); @@ -1106,26 +1110,26 @@ void Gfx::opSetExtGState(Object args[], int numArgs) } else { // "Luminosity" alpha = false; } - funcs[0] = nullptr; + Function *softMaskTransferFunc = nullptr; obj3 = obj2.dictLookup("TR"); if (!obj3.isNull()) { if (obj3.isName("Default") || obj3.isName("Identity")) { - funcs[0] = nullptr; + // nothing } else { - funcs[0] = Function::parse(&obj3); - if (funcs[0] == nullptr || funcs[0]->getInputSize() != 1 || funcs[0]->getOutputSize() != 1) { + softMaskTransferFunc = Function::parse(&obj3); + if (softMaskTransferFunc == nullptr || softMaskTransferFunc->getInputSize() != 1 || softMaskTransferFunc->getOutputSize() != 1) { error(errSyntaxError, getPos(), "Invalid transfer function in soft mask in ExtGState"); - delete funcs[0]; - funcs[0] = nullptr; + delete softMaskTransferFunc; + softMaskTransferFunc = nullptr; } } } obj3 = obj2.dictLookup("BC"); if ((haveBackdropColor = obj3.isArray())) { - for (i = 0; i < gfxColorMaxComps; ++i) { - backdropColor.c[i] = 0; + for (int &c : backdropColor.c) { + c = 0; } - for (i = 0; i < obj3.arrayGetLength() && i < gfxColorMaxComps; ++i) { + for (int i = 0; i < obj3.arrayGetLength() && i < gfxColorMaxComps; ++i) { Object obj4 = obj3.arrayGet(i); if (obj4.isNum()) { backdropColor.c[i] = dblToCol(obj4.getNum()); @@ -1148,12 +1152,12 @@ void Gfx::opSetExtGState(Object args[], int numArgs) blendingColorSpace->getDefaultColor(&backdropColor); } else { //~ need to get the parent or default color space (?) - for (i = 0; i < gfxColorMaxComps; ++i) { - backdropColor.c[i] = 0; + for (int &c : backdropColor.c) { + c = 0; } } } - doSoftMask(&obj3, alpha, blendingColorSpace, isolated, knockout, funcs[0], &backdropColor); + doSoftMask(&obj3, alpha, blendingColorSpace, isolated, knockout, softMaskTransferFunc, &backdropColor); delete blendingColorSpace; } else { error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group"); @@ -1161,7 +1165,7 @@ void Gfx::opSetExtGState(Object args[], int numArgs) } else { error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group"); } - delete funcs[0]; + delete softMaskTransferFunc; } else if (!obj2.isNull()) { error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState"); } _______________________________________________ poppler mailing list poppler@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/poppler