diff options
author | Ken Sharp <ken.sharp@artifex.com> | 2022-08-25 17:22:33 +0100 |
---|---|---|
committer | Chris Liddell <chris.liddell@artifex.com> | 2022-09-02 15:59:06 +0100 |
commit | a7b79c06ef8f4c6d5dd48136907f83ae5a74862b (patch) | |
tree | 2e418b0f0b1bb1269d4db8f60c9aa3d560c62f05 | |
parent | 56b17d62fdffcda16e053166f848a2a335d8ec7d (diff) | |
download | ghostpdl-a7b79c06ef8f4c6d5dd48136907f83ae5a74862b.tar.gz |
Coverity ID 380512
We were not using the return value from pdfi_array_get_number(). Since
we're making changes anyway, duplicate the fix in commit
0cbcfd63c0865a8c3a8d9d4bd81ba27cb0432487 to avoid storing the
dereferenced object in the array, in case we end up with a CropBox
where the array contains an indirect reference to the Pages tree.
The earlier commit only updated the array we were using for the canvas
size.
-rw-r--r-- | pdf/pdf_page.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/pdf/pdf_page.c b/pdf/pdf_page.c index 2799f86e3..b413b68dc 100644 --- a/pdf/pdf_page.c +++ b/pdf/pdf_page.c @@ -295,14 +295,23 @@ static int pdfi_set_media_size(pdf_context *ctx, pdf_dict *page_dict) if (a == NULL) { code = pdfi_dict_get_type(ctx, page_dict, "CropBox", PDF_ARRAY, (pdf_obj **)&a); if (code >= 0 && pdfi_array_size(a) >= 4) { + pdf_obj *box_obj = NULL; + for (i=0;i<4;i++) { - code = pdfi_array_get_number(ctx, a, i, &d_crop[i]); - d_crop[i] *= userunit; + code = pdfi_array_get_no_store_R(ctx, a, i, &box_obj); + if (code >= 0) { + code = pdfi_obj_to_real(ctx, box_obj, &d_crop[i]); + pdfi_countdown(box_obj); + } + if (code < 0) + break; } pdfi_countdown(a); - normalize_rectangle(d_crop); - memcpy(ctx->page.Crop, d_crop, 4 * sizeof(double)); - do_crop = true; + if (code >= 0) { + normalize_rectangle(d_crop); + memcpy(ctx->page.Crop, d_crop, 4 * sizeof(double)); + do_crop = true; + } } a = default_media; } |