310da4e
From 61ee992bf2e132da2168754f587fcf163a68eb12 Mon Sep 17 00:00:00 2001
310da4e
Message-Id: <61ee992bf2e132da2168754f587fcf163a68eb12.1666169658.git.mjg@fedoraproject.org>
310da4e
From: Ken Sharp <ken.sharp@artifex.com>
310da4e
Date: Thu, 19 May 2022 16:59:05 +0100
310da4e
Subject: [PATCH] GhostPDF - use proper bounds check for subfunctions of type 3
310da4e
310da4e
Bug #705225 "Gradients not rendered with the new PDF interpreter"
310da4e
310da4e
The files in question have some remarkably complicated functions used
310da4e
to define a shading. One has a type 3 stitching function with 33 type 2
310da4e
subfunctions, to define basically a blue fill....
310da4e
310da4e
The Domain of the shading is, additionally, unusual ranging from
310da4e
negative to positive instead of the more usual 0 to N for the parametric
310da4e
variable.
310da4e
310da4e
The problem is that we were comparing the Domain of each subfunction
310da4e
against the Domain of the shading function, when in fact each sub
310da4e
function uses the relevant Encode parameter of the type 3 function
310da4e
and it is this that we should be checking against the Domain of the sub
310da4e
function.
310da4e
---
310da4e
 pdf/pdf_func.c | 25 +++++++++++++------------
310da4e
 1 file changed, 13 insertions(+), 12 deletions(-)
310da4e
310da4e
diff --git a/pdf/pdf_func.c b/pdf/pdf_func.c
310da4e
index 9537152ed..6e2d4e4e9 100644
310da4e
--- a/pdf/pdf_func.c
310da4e
+++ b/pdf/pdf_func.c
310da4e
@@ -560,6 +560,18 @@ pdfi_build_function_3(pdf_context *ctx, gs_function_params_t * mnDR,
310da4e
 
310da4e
     params.Functions = (const gs_function_t * const *)ptr;
310da4e
 
310da4e
+    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Bounds, function_dict, "Bounds");
310da4e
+    if (code < 0)
310da4e
+        goto function_3_error;
310da4e
+
310da4e
+    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Encode, function_dict, "Encode");
310da4e
+    if (code < 0)
310da4e
+        goto function_3_error;
310da4e
+
310da4e
+    if (code != 2 * params.k)
310da4e
+        goto function_3_error;
310da4e
+    code = 0;
310da4e
+
310da4e
     for (i = 0; i < params.k; ++i) {
310da4e
         pdf_obj * rsubfn = NULL;
310da4e
 
310da4e
@@ -578,23 +590,12 @@ pdfi_build_function_3(pdf_context *ctx, gs_function_params_t * mnDR,
310da4e
         if (code < 0)
310da4e
             goto function_3_error;
310da4e
 
310da4e
-        code = pdfi_build_sub_function(ctx, &ptr[i], shading_domain, num_inputs, rsubfn, page_dict);
310da4e
+        code = pdfi_build_sub_function(ctx, &ptr[i], &params.Encode[i * 2], num_inputs, rsubfn, page_dict);
310da4e
         pdfi_countdown(rsubfn);
310da4e
         if (code < 0)
310da4e
             goto function_3_error;
310da4e
     }
310da4e
 
310da4e
-    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Bounds, function_dict, "Bounds");
310da4e
-    if (code < 0)
310da4e
-        goto function_3_error;
310da4e
-
310da4e
-    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Encode, function_dict, "Encode");
310da4e
-    if (code < 0)
310da4e
-        goto function_3_error;
310da4e
-
310da4e
-    if (code != 2 * params.k)
310da4e
-        goto function_3_error;
310da4e
-
310da4e
     if (params.Range == 0)
310da4e
         params.n = params.Functions[0]->params.n;
310da4e
 
310da4e
-- 
310da4e
2.38.0.124.g8fc341881c
310da4e