Fw: pdfwrite segfault

----- Original Message ----- 
From: "Igor V. Melichev" <[email protected]>
To: "Stefan Kemper" <[email protected]>
Cc: <[email protected]>
Sent: Sunday, April 03, 2005 9:26 PM
Subject: Re: pdfwrite segfault


> Stefan,
>
> Your change looks good.
>
> Actually I'm hard to maintain the mode !have_pattern_streams,
> since Ghostscript doesn't use this mode.
> Only PCL interpreter does.
> Your case never happens with Ghostscript.
>
> I looked through pdf_put_colored_pattern,
> and I think that it never returns null pointer with non-negative code.
> So I think the change (1) would not be useful useful.
>
> A long ago I've opened the bug 687303 - see
> http://bugs.ghostscript.com/show_bug.cgi?id=687303
> The goal is to discontinue the node !have_pattern_streams.
> Unfortunately I had no time for it yet.
> But I believe that I'll have in this year.
> Supporting two modes is too hard.
>
> Igor.
>
>
>
> ----- Original Message ----- 
> From: "Stefan Kemper" <[email protected]>
> To: "Igor V. Melichev" <[email protected]>
> Cc: <[email protected]>
> Sent: Friday, April 01, 2005 10:20 PM
> Subject: pdfwrite segfault
>
>
>> Igor,
>>
>> Thought I would let you structure error handling in your code the way you 
>> want...
>>
>> The change I just committed has another potential problem, but I don't 
>> have a test case for it.
>>
>> gdevpdfg.c line 301
>>
>>        if (pdc->type == gx_dc_type_pattern) {
>>            code = pdf_put_colored_pattern(pdev, pdc, pcs,
>>                ppscc, pis->have_pattern_streams, &pres);           1) if 
>> (code < 0 || pres == 0)
>> 1)              return code;
>>        }  else if (pdc->type == &gx_dc_pure_masked) {
>>            code = pdf_put_uncolored_pattern(pdev, pdc, pcs,
>>                ppscc, pis->have_pattern_streams, &pres);
>> 2)          if (code < 0 || pres == 0)
>>               return code;
>>            if (pis->have_pattern_streams)
>>               code = pdf_write_ccolor(pdev, pis, pcc);
>>        } else if (pdc->type == &gx_dc_pattern2)
>>            code = pdf_put_pattern2(pdev, pdc, ppscc, &pres);
>>        else
>>            return_error(pdev->memory, gs_error_rangecheck);
>>        if (code < 0)
>>            return code;
>>        cos_value_write(cos_resource_value(&cs_value, pres->object), 
>> pdev);
>>
>>
>> Change 2) is committed.
>>
>> Change 1) isn't committed.
>> The issue in both cases is that pdf_put_uncolored_pattern() can set
>> pres = null
>> then the last line shown dereferences the null.
>>
>>
>> Stefan
>>
>