I've noticed there's a crash in pdf2swf when using poly2bitmap dude to
the use of sizeof SplashColor in BitmapOutputDev to get the number of
color components. Attached patch should fix the crash.

Regards, 
-- 
Carlos Garcia Campos
http://pgp.rediris.es:11371/pks/lookup?op=get&search=0xF3D322D0EC4582C3
From e88b0aab3142fb383e9a9c9c82219a63437f4726 Mon Sep 17 00:00:00 2001
From: Carlos Garcia Campos <[email protected]>
Date: Thu, 21 Jun 2012 09:50:45 +0200
Subject: [PATCH] Don't use sizeof SplashColor as the number of color
 components

That's not valid for poppler where sizeof SplashColor is always 4, but
number of color components depend on the bitmap color mode. Use
splashColorModeNComps array instead. This fixes a crash in
BitmapOutputDev::flushBitmap() when using poppler.
---
 lib/pdf/BitmapOutputDev.cc     |    8 +++++---
 lib/pdf/FullBitmapOutputDev.cc |    3 ++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/pdf/BitmapOutputDev.cc b/lib/pdf/BitmapOutputDev.cc
index 11fa842..5b24dfe 100644
--- a/lib/pdf/BitmapOutputDev.cc
+++ b/lib/pdf/BitmapOutputDev.cc
@@ -199,6 +199,7 @@ void BitmapOutputDev::flushBitmap()
     
     SplashColorPtr rgb = rgbbitmap->getDataPtr();
     Guchar*alpha = rgbbitmap->getAlphaPtr();
+    int color_comps = splashColorModeNComps[rgbbitmap->getMode()];
     
     Guchar*alpha2 = stalepolybitmap->getDataPtr();
     int bitmap_width8 = (stalepolybitmap->getWidth()+7)/8;
@@ -256,7 +257,7 @@ void BitmapOutputDev::flushBitmap()
 	img->height = rangey;
 	int x,y;
 	for(y=0;y<rangey;y++) {
-	    SplashColorPtr in=&rgb[((y+ymin)*bitmap_width+xmin)*sizeof(SplashColor)];
+	    SplashColorPtr in=&rgb[((y+ymin)*bitmap_width+xmin)*color_comps];
 	    gfxcolor_t*out = &img->data[y*rangex];
 	    Guchar*ain = &alpha[(y+ymin)*bitmap_width+xmin];
 	    Guchar*ain2 = &alpha2[(y+ymin)*bitmap_width8];
@@ -1458,8 +1459,9 @@ char area_is_plain_colored(GfxState*state, SplashBitmap*boolpoly, SplashBitmap*r
 	return 0;
     }
     gfxcolor_t color = gfxstate_getfillcolor(state);
+    int color_comps = splashColorModeNComps[rgbbitmap->getMode()];
     SplashColorPtr rgb = rgbbitmap->getDataPtr() 
-	               + (y1*width+x1)*sizeof(SplashColor);
+	               + (y1*width+x1)*color_comps;
     int width8 = (width+7)/8;
     unsigned char*bits = (unsigned char*)boolpoly->getDataPtr() 
 	                 + (y1*width8+x1);
@@ -1473,7 +1475,7 @@ char area_is_plain_colored(GfxState*state, SplashBitmap*boolpoly, SplashBitmap*r
 	       rgb[x*3+2] != color.b)
 		return 0;
 	}
-	rgb += width*sizeof(SplashColor);
+	rgb += width*color_comps;
     }
     return 1;
 }
diff --git a/lib/pdf/FullBitmapOutputDev.cc b/lib/pdf/FullBitmapOutputDev.cc
index b9efc8e..6b0a854 100644
--- a/lib/pdf/FullBitmapOutputDev.cc
+++ b/lib/pdf/FullBitmapOutputDev.cc
@@ -115,6 +115,7 @@ void FullBitmapOutputDev::flushBitmap()
     
     SplashColorPtr rgb = rgbdev->getBitmap()->getDataPtr();
     Guchar*alpha = rgbdev->getBitmap()->getAlphaPtr();
+    int color_comps = splashColorModeNComps[rgbdev->getBitmap()->getMode()];
 
     int xmin,ymin,xmax,ymax;
     getBitmapBBox(alpha, width, height, &xmin,&ymin,&xmax,&ymax);
@@ -146,7 +147,7 @@ void FullBitmapOutputDev::flushBitmap()
     img->height = rangey;
     int x,y;
     for(y=0;y<rangey;y++) {
-	SplashColorPtr in=&rgb[((y+ymin)*width+xmin)*sizeof(SplashColor)];
+	SplashColorPtr in=&rgb[((y+ymin)*width+xmin)*color_comps];
 	gfxcolor_t*out = &img->data[y*rangex];
 	Guchar*ain = &alpha[(y+ymin)*width+xmin];
 	for(x=0;x<rangex;x++) {
-- 
1.7.9.5

Attachment: signature.asc
Description: This is a digitally signed message part

---------------
SWFTools-common is a self-managed list. To subscribe/unsubscribe, or amend an 
existing subscription, please kindly point your favourite web browser 
at:<http://lists.nongnu.org/mailman/listinfo/swftools-common>

Reply via email to