[gs-cvs] rev 8406 - trunk/gs/src

[ken at ghostscript.com]

Author: ken
Date: 2007-11-23 01:23:06 -0800 (Fri, 23 Nov 2007)
New Revision: 8406

Modified:
   trunk/gs/src/gdevpsfu.c
   trunk/gs/src/gxtype1.c
Log:
Fix (pdfwrite): Fonts containing glyphs with no sbw or hsbw
instruction caused pdfwrite to crash.

Details:
Bug #689544 "Segmentation fault writing PDF file".

The job contains a number of fonts apparently converted from 
TrueType to type 1. The /.notdef glyph in every case consists
only of an endchar instruction. Techincally invalid since the 
specification says the first instruction must be either an sbw
or hsbw instruction.

This causes a crash because gs_type1_glyph_info didn't create
a path before interpreting the glyph. If we encountered a path
operation before a sbw instruction we attempted to write to the 
non-existent path.

(gxtype1.c), gs_type1_glyph_info, create a path for the type 1
interpreter to work with. Make it a bbox_accumulator so we don't
allocate memory for path segments.

(gdevpsfu.c), psf_check_outline_glyphs, if we get an invalidfont
error return from the font's 'glyph_info' procedure, don't exit
immediately. Check each glyph, and only return an error if 
there are no good glyphs. 

EXPECTED DIFFERENCES:
None.


Modified: trunk/gs/src/gdevpsfu.c
===================================================================
--- trunk/gs/src/gdevpsfu.c	2007-11-22 02:46:59 UTC (rev 8405)
+++ trunk/gs/src/gdevpsfu.c	2007-11-23 09:23:06 UTC (rev 8406)
@@ -206,7 +206,7 @@
 {
     uint members = GLYPH_INFO_WIDTH0 << pfont->WMode;
     gs_glyph glyph;
-    int code;
+    int code, good_glyphs = 0;
 
     while ((code = psf_enumerate_glyphs_next(ppge, &glyph)) != 1) {
 	gs_glyph_data_t gdata;
@@ -235,10 +235,22 @@
 	 */
 	code = pfont->procs.glyph_info((gs_font *)pfont, glyph, NULL,
 				       members, &info);
+
+	/* It may be that a single glyph is bad (eg no (h)sbw), we'll ignore it */
+	/* here, the glyph may not be included in any subset, or not used at all */
+	/* (ie the /.notdef). If an invalid glyoh is actually used then the text */
+	/* processing will still signal an error causing the document to fail. */
+	if(code == gs_error_invalidfont)
+	    continue;
+
 	if (code < 0)
 	    return code;
+	good_glyphs++;
     }
-    return 0;
+    if(good_glyphs)
+	return 0;
+    else
+	return_error(gs_error_invalidfont);
 }
 
 /* Gather glyph information for a Type 1 or Type 2 font. */

Modified: trunk/gs/src/gxtype1.c
===================================================================
--- trunk/gs/src/gxtype1.c	2007-11-22 02:46:59 UTC (rev 8405)
+++ trunk/gs/src/gxtype1.c	2007-11-23 09:23:06 UTC (rev 8406)
@@ -545,6 +545,7 @@
     }
 
     if (width_members) {
+	gx_path path;
 	/*
 	 * Interpret the CharString until we get to the [h]sbw.
 	 */
@@ -567,6 +568,8 @@
 	if (code < 0)
 	    return code;
 	cis.no_grid_fitting = true;
+	gx_path_init_bbox_accumulator(&path);
+	cis.path = &path;
 	code = pdata->interpret(&cis, &gdata, &value);
 	switch (code) {
 	case 0:		/* done with no [h]sbw, error */