[gs-commits] mupdf 1.16.1.epub-prerelease-24 Fix read/write pointer bu

commit d5c6cbe6fc46981daa2df400e3930865cf18c2eb
Author: Sebastian Rasmussen <[email protected]>
Date:   Mon Nov 4 02:42:30 2019 +0100

    Fix read/write pointer bug in concat filter.
    
    Consider a user having called fz_read_byte() up to and including
    a whitespace padding byte between two concatenated streams.
    
    At this point the concat filter will internally have its read pointer
    pointing to the byte after the dummy padding byte, and its write pointer
    pointing to the next byte after that. This indicates that there is
    _still_ at least another byte remaining in the filter.
    
    If a user at this point calls fz_available(), it will return 1 because
    that is the difference between the write and read pointers. If the caller
    then calls fz_read_byte() again it will derefernce the read pointer,
    which points outside of the padding buffer.
    
    This commit sets the read and write pointers to both point to the
    byte in the filter immediately after the padding byte. Therebye indicating
    that the internal buffer has no more data to provide. This causes
    fz_available() under the circumstances above to call next_concat()
    and then fill the concat filter buffer with data from the next
    concatenated filter. The same happens if fz_read_byte() is called.
    
    Coverity CID 77027 prompted a review of the next_concat() code.

diff --git a/source/fitz/filter-basic.c b/source/fitz/filter-basic.c
index 0713a62..80c496b 100644
--- a/source/fitz/filter-basic.c
+++ b/source/fitz/filter-basic.c
@@ -332,8 +332,7 @@ next_concat(fz_context *ctx, fz_stream *stm, size_t max)
 			fz_drop_stream(ctx, state->chain[state->current-1]);
 			if (state->pad)
 			{
-				stm->rp = (&state->ws_buf)+1;
-				stm->wp = stm->rp + 1;
+				stm->wp = stm->rp = (&state->ws_buf)+1;
 				stm->pos++;
 				return 32;
 			}

http://git.ghostscript.com/?p=mupdf.git;a=commit;h=d5c6cbe6fc46981daa2df400e3930865cf18c2eb

--
MuPDF library
Artifex Software, Inc.