From 61ee992bf2e132da2168754f587fcf163a68eb12 Mon Sep 17 00:00:00 2001
Message-Id: <61ee992bf2e132da2168754f587fcf163a68eb12.1666169658.git.mjg@fedoraproject.org>
From: Ken Sharp <ken.sharp@artifex.com>
Date: Thu, 19 May 2022 16:59:05 +0100
Subject: [PATCH] GhostPDF - use proper bounds check for subfunctions of type 3

Bug #705225 "Gradients not rendered with the new PDF interpreter"

The files in question have some remarkably complicated functions used
to define a shading. One has a type 3 stitching function with 33 type 2
subfunctions, to define basically a blue fill....

The Domain of the shading is, additionally, unusual ranging from
negative to positive instead of the more usual 0 to N for the parametric
variable.

The problem is that we were comparing the Domain of each subfunction
against the Domain of the shading function, when in fact each sub
function uses the relevant Encode parameter of the type 3 function
and it is this that we should be checking against the Domain of the sub
function.
---
 pdf/pdf_func.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pdf/pdf_func.c b/pdf/pdf_func.c
index 9537152ed..6e2d4e4e9 100644
--- a/pdf/pdf_func.c
+++ b/pdf/pdf_func.c
@@ -560,6 +560,18 @@ pdfi_build_function_3(pdf_context *ctx, gs_function_params_t * mnDR,
 
     params.Functions = (const gs_function_t * const *)ptr;
 
+    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Bounds, function_dict, "Bounds");
+    if (code < 0)
+        goto function_3_error;
+
+    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Encode, function_dict, "Encode");
+    if (code < 0)
+        goto function_3_error;
+
+    if (code != 2 * params.k)
+        goto function_3_error;
+    code = 0;
+
     for (i = 0; i < params.k; ++i) {
         pdf_obj * rsubfn = NULL;
 
@@ -578,23 +590,12 @@ pdfi_build_function_3(pdf_context *ctx, gs_function_params_t * mnDR,
         if (code < 0)
             goto function_3_error;
 
-        code = pdfi_build_sub_function(ctx, &ptr[i], shading_domain, num_inputs, rsubfn, page_dict);
+        code = pdfi_build_sub_function(ctx, &ptr[i], &params.Encode[i * 2], num_inputs, rsubfn, page_dict);
         pdfi_countdown(rsubfn);
         if (code < 0)
             goto function_3_error;
     }
 
-    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Bounds, function_dict, "Bounds");
-    if (code < 0)
-        goto function_3_error;
-
-    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Encode, function_dict, "Encode");
-    if (code < 0)
-        goto function_3_error;
-
-    if (code != 2 * params.k)
-        goto function_3_error;
-
     if (params.Range == 0)
         params.n = params.Functions[0]->params.n;
 
-- 
2.38.0.124.g8fc341881c