Bug 694318: remove reference to freed resource

When we're about to free a PDF resource object in pdfwrite, make sure we remove
references to it in the substream stack.

No cluster differences

2 files changed, 16 insertions, 1 deletions

diff --git a/gs/devices/vector/gdevpdf.c b/gs/devices/vector/gdevpdf.c
index 5b8750799..e5cb00e56 100644
--- a/gs/devices/vector/gdevpdf.c
+++ b/gs/devices/vector/gdevpdf.c
@@ -2781,8 +2781,8 @@ pdf_close(gx_device * dev)
                     cos_release(pres->object, "free function dict");
                     gs_free_object(pdev->pdf_memory, pres->object, "free function resources");
                     pres->object = 0;
-                    pnext = pres->next;
                 }
+                pnext = pres->next;
                 pres = pnext;
             }
         }
diff --git a/gs/devices/vector/gdevpdfu.c b/gs/devices/vector/gdevpdfu.c
index cc8986672..e8fd5272d 100644
--- a/gs/devices/vector/gdevpdfu.c
+++ b/gs/devices/vector/gdevpdfu.c
@@ -1131,6 +1131,21 @@ pdf_forget_resource(gx_device_pdf * pdev, pdf_resource_t *pres1, pdf_resource_ty
     pdf_resource_t **pprev = &pdev->last_resource;
     int i;
 
+    /* since we're about to free the resource, we can just set
+       any of these references to null
+    */
+    for (i = 0; i < pdev->sbstack_size; i++) {
+        if (pres1 == pdev->sbstack[i].font3) {
+            pdev->sbstack[i].font3 = NULL;
+        }
+        else if (pres1 == pdev->sbstack[i].accumulating_substream_resource) {
+            pdev->sbstack[i].accumulating_substream_resource = NULL;
+        }
+        else if (pres1 == pdev->sbstack[i].pres_soft_mask_dict) {
+            pdev->sbstack[i].pres_soft_mask_dict = NULL;
+        }
+    }
+
     for (; (pres = *pprev) != 0; pprev = &pres->prev)
         if (pres == pres1) {
             *pprev = pres->prev;