Re: [poppler] splash/SplashBitmap.cc splash/Splash.cc

[Thomas Freitag]

Hi Albert!

This commit probably fixes the abort, but I fear the PDF will not be 
rendered, does it? The reason for it is that this bug is a duplicate of 
the poppler bug 49523, it causes a bogus memory allocation size in pdftoppm.
Therefore I created a rebased patch for that bug and attached it there, 
so pdftoppm ist able to render also the PDF if KDE bug #302372.

Cheers,
Thomas

On 24.06.2012 23:43, Albert Astals Cid wrote:
  splash/Splash.cc       |   37 +++++++++++++++++++++++--------------
  splash/SplashBitmap.cc |   18 +++++++++++-------
  2 files changed, 34 insertions(+), 21 deletions(-)

New commits:
commit f48eb669ae5c729c026554802e666e64399c0900
Author: Albert Astals Cid<aa...@kde.org>
Date:   Sun Jun 24 23:43:03 2012 +0200

     Change SplashBitmap gmallocn to gmallocn_checkoverflow

     Fixes abort in KDE bug #302372

diff --git a/splash/Splash.cc b/splash/Splash.cc
index e5f7667..0e07c70 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -11,7 +11,7 @@
  // All changes made under the Poppler project to this file are licensed
  // under GPL version 2 or later
  //
-// Copyright (C) 2005-2011 Albert Astals Cid<aa...@kde.org>
+// Copyright (C) 2005-2012 Albert Astals Cid<aa...@kde.org>
  // Copyright (C) 2005 Marco Pesenti Gritti<m...@redhat.com>
  // Copyright (C) 2010-2012 Thomas Freitag<thomas.frei...@alfa.de>
  // Copyright (C) 2010 Christian Feuersänger<cfeuersaen...@googlemail.com>
@@ -3625,6 +3625,10 @@ SplashError 
Splash::arbitraryTransformImage(SplashImageSource src, void *srcData
    }
    scaledImg = scaleImage(src, srcData, srcMode, nComps, srcAlpha,
                         srcWidth, srcHeight, scaledWidth, scaledHeight);
+
+  if (scaledImg == NULL) {
+    return splashErrBadArg;
+  }

    // construct the three sections
    i = 0;
@@ -3803,22 +3807,27 @@ SplashBitmap *Splash::scaleImage(SplashImageSource src, 
void *srcData,
    SplashBitmap *dest;

    dest = new SplashBitmap(scaledWidth, scaledHeight, 1, srcMode, srcAlpha);
-  if (scaledHeight<  srcHeight) {
-    if (scaledWidth<  srcWidth) {
-      scaleImageYdXd(src, srcData, srcMode, nComps, srcAlpha,
-                    srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+  if (dest->getDataPtr() != NULL) {
+    if (scaledHeight<  srcHeight) {
+      if (scaledWidth<  srcWidth) {
+       scaleImageYdXd(src, srcData, srcMode, nComps, srcAlpha,
+                     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      } else {
+       scaleImageYdXu(src, srcData, srcMode, nComps, srcAlpha,
+                     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      }
      } else {
-      scaleImageYdXu(src, srcData, srcMode, nComps, srcAlpha,
-                    srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      if (scaledWidth<  srcWidth) {
+       scaleImageYuXd(src, srcData, srcMode, nComps, srcAlpha,
+                     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      } else {
+       scaleImageYuXu(src, srcData, srcMode, nComps, srcAlpha,
+                     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      }
      }
    } else {
-    if (scaledWidth<  srcWidth) {
-      scaleImageYuXd(src, srcData, srcMode, nComps, srcAlpha,
-                    srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
-    } else {
-      scaleImageYuXu(src, srcData, srcMode, nComps, srcAlpha,
-                    srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
-    }
+    delete dest;
+    dest = NULL;
    }
    return dest;
  }
diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc
index e4f27fc..cd85543 100644
--- a/splash/SplashBitmap.cc
+++ b/splash/SplashBitmap.cc
@@ -101,13 +101,17 @@ SplashBitmap::SplashBitmap(int widthA, int heightA, int 
rowPadA,
      rowSize += rowPad - 1;
      rowSize -= rowSize % rowPad;
    }
-  data = (SplashColorPtr)gmallocn(rowSize, height);
-  if (!topDown) {
-    data += (height - 1) * rowSize;
-    rowSize = -rowSize;
-  }
-  if (alphaA) {
-    alpha = (Guchar *)gmallocn(width, height);
+  data = (SplashColorPtr)gmallocn_checkoverflow(rowSize, height);
+  if (data != NULL) {
+    if (!topDown) {
+      data += (height - 1) * rowSize;
+      rowSize = -rowSize;
+    }
+    if (alphaA) {
+      alpha = (Guchar *)gmallocn(width, height);
+    } else {
+      alpha = NULL;
+    }
    } else {
      alpha = NULL;
    }


_______________________________________________
poppler mailing list
poppler@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/poppler

_______________________________________________
poppler mailing list
poppler@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/poppler