poppler/Gfx.cc | 31 ++++++++++++------------------- poppler/Gfx.h | 4 ++-- 2 files changed, 14 insertions(+), 21 deletions(-)
New commits: commit 0a1174ff7043cbdc7195a5df562a96bd0033cb95 Author: Albert Astals Cid <[email protected]> Date: Sat Jan 2 22:15:39 2021 +0100 Rework a bit the "infinite" recursion detection of Gfx Instead of counting drawForm calls, count non toplevel display calls Remove a check from Gfx::doSoftMask which doesn't seem like it would do anything, let's hope the automatic fuzzer finds out if it does, git log says it comes from the xpdf3.02 merge This fixes issue #1021 diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc index 78adcf79..20d450ed 100644 --- a/poppler/Gfx.cc +++ b/poppler/Gfx.cc @@ -14,7 +14,7 @@ // under GPL version 2 or later // // Copyright (C) 2005 Jonathan Blandford <[email protected]> -// Copyright (C) 2005-2013, 2015-2020 Albert Astals Cid <[email protected]> +// Copyright (C) 2005-2013, 2015-2021 Albert Astals Cid <[email protected]> // Copyright (C) 2006 Thorkild Stray <[email protected]> // Copyright (C) 2006 Kristian Høgsberg <[email protected]> // Copyright (C) 2006-2011 Carlos Garcia Campos <[email protected]> @@ -483,7 +483,7 @@ Gfx::Gfx(PDFDoc *docA, OutputDev *outA, int pageNum, Dict *resDict, double hDPI, for (i = 0; i < 6; ++i) { baseMatrix[i] = state->getCTM()[i]; } - formDepth = 0; + displayDepth = 0; ocState = true; parser = nullptr; abortCheckCbk = abortCheckCbkA; @@ -544,7 +544,7 @@ Gfx::Gfx(PDFDoc *docA, OutputDev *outA, Dict *resDict, const PDFRectangle *box, for (i = 0; i < 6; ++i) { baseMatrix[i] = state->getCTM()[i]; } - formDepth = 0; + displayDepth = 0; ocState = true; parser = nullptr; abortCheckCbk = abortCheckCbkA; @@ -622,10 +622,13 @@ Gfx::~Gfx() void Gfx::display(Object *obj, bool topLevel) { - int i; + // check for excessive recursion + if (displayDepth > 100) { + return; + } if (obj->isArray()) { - for (i = 0; i < obj->arrayGetLength(); ++i) { + for (int i = 0; i < obj->arrayGetLength(); ++i) { Object obj2 = obj->arrayGet(i); if (!obj2.isStream()) { error(errSyntaxError, -1, "Weird page contents"); @@ -1236,11 +1239,6 @@ void Gfx::doSoftMask(Object *str, bool alpha, GfxColorSpace *blendingColorSpace, Object obj1; int i; - // check for excessive recursion - if (formDepth > 20) { - return; - } - // get stream dict dict = str->streamGetDict(); @@ -1290,9 +1288,7 @@ void Gfx::doSoftMask(Object *str, bool alpha, GfxColorSpace *blendingColorSpace, resDict = obj1.isDict() ? obj1.getDict() : nullptr; // draw it - ++formDepth; drawForm(str, resDict, m, bbox, true, true, blendingColorSpace, isolated, knockout, alpha, transferFunc, backdropColor); - --formDepth; } void Gfx::opSetRenderingIntent(Object args[], int numArgs) @@ -3920,7 +3916,9 @@ void Gfx::doShowText(const GooString *s) } } if (displayCharProc) { + ++displayDepth; display(&charProc, false); + --displayDepth; if (refNum != -1) { charProcDrawing.erase(charProcDrawingIt); @@ -4604,11 +4602,6 @@ void Gfx::doForm(Object *str) Object obj1; int i; - // check for excessive recursion - if (formDepth > 100) { - return; - } - // get stream dict dict = str->streamGetDict(); @@ -4693,9 +4686,7 @@ void Gfx::doForm(Object *str) } // draw it - ++formDepth; drawForm(str, resDict, m, bbox, transpGroup, false, blendingColorSpace, isolated, knockout); - --formDepth; if (blendingColorSpace) { delete blendingColorSpace; @@ -4764,7 +4755,9 @@ void Gfx::drawForm(Object *str, Dict *resDict, const double *matrix, const doubl GfxState *stateBefore = state; // draw the form + ++displayDepth; display(str, false); + --displayDepth; if (stateBefore != state) { if (state->isParentState(stateBefore)) { diff --git a/poppler/Gfx.h b/poppler/Gfx.h index 808f23c3..3539bd69 100644 --- a/poppler/Gfx.h +++ b/poppler/Gfx.h @@ -17,7 +17,7 @@ // Copyright (C) 2007 Iñigo Martínez <[email protected]> // Copyright (C) 2008 Brad Hards <[email protected]> // Copyright (C) 2008, 2010 Carlos Garcia Campos <[email protected]> -// Copyright (C) 2009-2013, 2017, 2018 Albert Astals Cid <[email protected]> +// Copyright (C) 2009-2013, 2017, 2018, 2021 Albert Astals Cid <[email protected]> // Copyright (C) 2009, 2010, 2012, 2013 Thomas Freitag <[email protected]> // Copyright (C) 2010 David Benjamin <[email protected]> // Copyright (C) 2010 Christian Feuersänger <[email protected]> @@ -217,7 +217,7 @@ private: int ignoreUndef; // current BX/EX nesting level double baseMatrix[6]; // default matrix for most recent // page/form/pattern - int formDepth; + int displayDepth; bool ocState; // true if drawing is enabled, false if // disabled _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
