summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Vrhel <michael.vrhel@artifex.com>2022-03-03 16:11:17 -0800
committerChris Liddell <chris.liddell@artifex.com>2022-03-05 10:19:42 +0000
commit53ba4f82b968fbd755cdf5da1e4bdb9a571bb349 (patch)
tree95f6cef3d46892a15e1c166afbde3d7974345a96
parent439b802a82d0d3c55c9f0de757f4f9c9eed48e86 (diff)
downloadghostpdl-53ba4f82b968fbd755cdf5da1e4bdb9a571bb349.tar.gz
oss-fuzz 44604 pdf14 shading fills with bbox that are empty
Compute the actual bbox. If is is empty, then do not continue with the drawing. Was leading to a seg fault later due to a confused pdf14 device which eventually ends in a pdf14 abort operation.
-rw-r--r--base/gdevp14.c18
1 files changed, 16 insertions, 2 deletions
diff --git a/base/gdevp14.c b/base/gdevp14.c
index 73e3b0c14..1919f72b3 100644
--- a/base/gdevp14.c
+++ b/base/gdevp14.c
@@ -11021,10 +11021,15 @@ pdf14_clist_fill_path(gx_device *dev, const gs_gstate *pgs,
}
if (push_group) {
gs_fixed_rect box;
- if (pcpath)
+ gs_fixed_rect dev_bbox;
+
+ if (pcpath) {
gx_cpath_outer_box(pcpath, &box);
- else
+ (*dev_proc(dev, get_clipping_box)) (dev, &dev_bbox);
+ rect_intersect(box, dev_bbox);
+ } else
(*dev_proc(dev, get_clipping_box)) (dev, &box);
+
if (ppath) {
gs_fixed_rect path_box;
@@ -11038,6 +11043,15 @@ pdf14_clist_fill_path(gx_device *dev, const gs_gstate *pgs,
if (box.q.y > path_box.q.y)
box.q.y = path_box.q.y;
}
+
+ if (box.p.y >= box.q.y || box.p.x >= box.q.x) {
+ /* No need to do anything */
+ if (pinst != NULL) {
+ pinst->saved->trans_device = NULL;
+ }
+ return 0;
+ }
+
/* Group alpha set from fill value. push_shfill_group does reset to 1.0 */
code = push_shfill_group(pdev, &new_pgs, &box);
} else