Attachment 23223 Details for Bug 58082

[patch] xref.patch

xref.patch (text/plain), 7.26 KB, created by Thomas Biege on 2004-09-08 17:55:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-09-08 17:55:05 UTC

Size: 7.26 KB

patch

obsolete

>*** XRef.cc.orig	Thu Jul 22 11:04:22 2004
>--- XRef.cc	Thu Jul 22 11:04:31 2004
>***************
>*** 96,102 ****
>    }
>    nObjects = obj1.getInt();
>    obj1.free();
>!   if (nObjects == 0) {
>      goto err1;
>    }
>  
>--- 96,102 ----
>    }
>    nObjects = obj1.getInt();
>    obj1.free();
>!   if (nObjects <= 0) {
>      goto err1;
>    }
>  
>***************
>*** 106,111 ****
>--- 106,114 ----
>    }
>    first = obj1.getInt();
>    obj1.free();
>+   if (first < 0) {
>+     goto err1;
>+   }
>  
>    objs = new Object[nObjects];
>    objNums = (int *)gmalloc(nObjects * sizeof(int));
>***************
>*** 130,135 ****
>--- 133,144 ----
>      offsets[i] = obj2.getInt();
>      obj1.free();
>      obj2.free();
>+     if (objNums[i] < 0 || offsets[i] < 0 ||
>+ 	(i > 0 && offsets[i] < offsets[i-1])) {
>+       delete parser;
>+       gfree(offsets);
>+       goto err1;
>+     }
>    }
>    while (str->getChar() != EOF) ;
>    delete parser;
>***************
>*** 369,378 ****
>      }
>      n = obj.getInt();
>      obj.free();
>      if (first + n > size) {
>        for (newSize = size ? 2 * size : 1024;
>! 	   first + n > newSize;
>  	   newSize <<= 1) ;
>        entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
>        for (i = size; i < newSize; ++i) {
>  	entries[i].offset = 0xffffffff;
>--- 378,393 ----
>      }
>      n = obj.getInt();
>      obj.free();
>+     if (first < 0 || n < 0 || first + n < 0) {
>+       goto err1;
>+     }
>      if (first + n > size) {
>        for (newSize = size ? 2 * size : 1024;
>! 	   first + n > newSize && newSize > 0;
>  	   newSize <<= 1) ;
>+       if (newSize < 0) {
>+ 	goto err1;
>+       }
>        entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
>        for (i = size; i < newSize; ++i) {
>  	entries[i].offset = 0xffffffff;
>***************
>*** 443,449 ****
>  
>    // check for an 'XRefStm' key
>    if (obj.getDict()->lookup("XRefStm", &obj2)->isInt()) {
>!     pos2 = obj2.getInt();
>      readXRef(&pos2);
>      if (!ok) {
>        goto err1;
>--- 458,464 ----
>  
>    // check for an 'XRefStm' key
>    if (obj.getDict()->lookup("XRefStm", &obj2)->isInt()) {
>!     pos2 = (Guint)obj2.getInt();
>      readXRef(&pos2);
>      if (!ok) {
>        goto err1;
>***************
>*** 474,479 ****
>--- 489,497 ----
>    }
>    newSize = obj.getInt();
>    obj.free();
>+   if (newSize < 0) {
>+     goto err1;
>+   }
>    if (newSize > size) {
>      entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
>      for (i = size; i < newSize; ++i) {
>***************
>*** 494,499 ****
>--- 512,520 ----
>      }
>      w[i] = obj2.getInt();
>      obj2.free();
>+     if (w[i] < 0 || w[i] > 4) {
>+       goto err1;
>+     }
>    }
>    obj.free();
>  
>***************
>*** 513,525 ****
>        }
>        n = obj.getInt();
>        obj.free();
>!       if (!readXRefStreamSection(xrefStr, w, first, n)) {
>  	idx.free();
>  	goto err0;
>        }
>      }
>    } else {
>!     if (!readXRefStreamSection(xrefStr, w, 0, size)) {
>        idx.free();
>        goto err0;
>      }
>--- 534,547 ----
>        }
>        n = obj.getInt();
>        obj.free();
>!       if (first < 0 || n < 0 ||
>! 	  !readXRefStreamSection(xrefStr, w, first, n)) {
>  	idx.free();
>  	goto err0;
>        }
>      }
>    } else {
>!     if (!readXRefStreamSection(xrefStr, w, 0, newSize)) {
>        idx.free();
>        goto err0;
>      }
>***************
>*** 551,560 ****
>    Guint offset;
>    int type, gen, c, newSize, i, j;
>  
>    if (first + n > size) {
>      for (newSize = size ? 2 * size : 1024;
>! 	 first + n > newSize;
>  	 newSize <<= 1) ;
>      entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
>      for (i = size; i < newSize; ++i) {
>        entries[i].offset = 0xffffffff;
>--- 573,588 ----
>    Guint offset;
>    int type, gen, c, newSize, i, j;
>  
>+   if (first + n < 0) {
>+     return gFalse;
>+   }
>    if (first + n > size) {
>      for (newSize = size ? 2 * size : 1024;
>! 	 first + n > newSize && newSize > 0;
>  	 newSize <<= 1) ;
>+     if (newSize < 0) {
>+       return gFalse;
>+     }
>      entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
>      for (i = size; i < newSize; ++i) {
>        entries[i].offset = 0xffffffff;
>***************
>*** 585,608 ****
>        }
>        gen = (gen << 8) + c;
>      }
>!     switch (type) {
>!     case 0:
>!       entries[i].offset = offset;
>!       entries[i].gen = gen;
>!       entries[i].type = xrefEntryFree;
>!       break;
>!     case 1:
>!       entries[i].offset = offset;
>!       entries[i].gen = gen;
>!       entries[i].type = xrefEntryUncompressed;
>!       break;
>!     case 2:
>!       entries[i].offset = offset;
>!       entries[i].gen = gen;
>!       entries[i].type = xrefEntryCompressed;
>!       break;
>!     default:
>!       return gFalse;
>      }
>    }
>  
>--- 613,638 ----
>        }
>        gen = (gen << 8) + c;
>      }
>!     if (entries[i].offset == 0xffffffff) {
>!       switch (type) {
>!       case 0:
>! 	entries[i].offset = offset;
>! 	entries[i].gen = gen;
>! 	entries[i].type = xrefEntryFree;
>! 	break;
>!       case 1:
>! 	entries[i].offset = offset;
>! 	entries[i].gen = gen;
>! 	entries[i].type = xrefEntryUncompressed;
>! 	break;
>!       case 2:
>! 	entries[i].offset = offset;
>! 	entries[i].gen = gen;
>! 	entries[i].type = xrefEntryCompressed;
>! 	break;
>!       default:
>! 	return gFalse;
>!       }
>      }
>    }
>  
>***************
>*** 664,701 ****
>      // look for object
>      } else if (isdigit(*p)) {
>        num = atoi(p);
>!       do {
>! 	++p;
>!       } while (*p && isdigit(*p));
>!       if (isspace(*p)) {
>  	do {
>  	  ++p;
>! 	} while (*p && isspace(*p));
>! 	if (isdigit(*p)) {
>! 	  gen = atoi(p);
>  	  do {
>  	    ++p;
>! 	  } while (*p && isdigit(*p));
>! 	  if (isspace(*p)) {
>  	    do {
>  	      ++p;
>! 	    } while (*p && isspace(*p));
>! 	    if (!strncmp(p, "obj", 3)) {
>! 	      if (num >= size) {
>! 		newSize = (num + 1 + 255) & ~255;
>! 		entries = (XRefEntry *)
>! 		            grealloc(entries, newSize * sizeof(XRefEntry));
>! 		for (i = size; i < newSize; ++i) {
>! 		  entries[i].offset = 0xffffffff;
>! 		  entries[i].type = xrefEntryFree;
>  		}
>- 		size = newSize;
>- 	      }
>- 	      if (entries[num].type == xrefEntryFree ||
>- 		  gen >= entries[num].gen) {
>- 		entries[num].offset = pos - start;
>- 		entries[num].gen = gen;
>- 		entries[num].type = xrefEntryUncompressed;
>  	      }
>  	    }
>  	  }
>--- 694,737 ----
>      // look for object
>      } else if (isdigit(*p)) {
>        num = atoi(p);
>!       if (num > 0) {
>  	do {
>  	  ++p;
>! 	} while (*p && isdigit(*p));
>! 	if (isspace(*p)) {
>  	  do {
>  	    ++p;
>! 	  } while (*p && isspace(*p));
>! 	  if (isdigit(*p)) {
>! 	    gen = atoi(p);
>  	    do {
>  	      ++p;
>! 	    } while (*p && isdigit(*p));
>! 	    if (isspace(*p)) {
>! 	      do {
>! 		++p;
>! 	      } while (*p && isspace(*p));
>! 	      if (!strncmp(p, "obj", 3)) {
>! 		if (num >= size) {
>! 		  newSize = (num + 1 + 255) & ~255;
>! 		  if (newSize < 0) {
>! 		    error(-1, "Bad object number");
>! 		    return gFalse;
>! 		  }
>! 		  entries = (XRefEntry *)
>! 		      grealloc(entries, newSize * sizeof(XRefEntry));
>! 		  for (i = size; i < newSize; ++i) {
>! 		    entries[i].offset = 0xffffffff;
>! 		    entries[i].type = xrefEntryFree;
>! 		  }
>! 		  size = newSize;
>! 		}
>! 		if (entries[num].type == xrefEntryFree ||
>! 		    gen >= entries[num].gen) {
>! 		  entries[num].offset = pos - start;
>! 		  entries[num].gen = gen;
>! 		  entries[num].type = xrefEntryUncompressed;
>  		}
>  	      }
>  	    }
>  	  }
>

Actions: View | Diff

Attachments on bug 58082: 22235 | 22236 | 23223 | 24853 | 24858 | 25136 | 25139 | 25625 | 25633