[poppler] Branch 'poppler-0.8' - poppler/CairoOutputDev.cc

[Carlos Garcia Campos]

 poppler/CairoOutputDev.cc |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

New commits:
commit 601a345d9e5ea173960d385351b40a73c9a8f687
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Tue Aug 19 09:18:03 2008 +0100

    Memleak and invalid free.
    
    CairoOutputDev::setSoftMask() fails to free the cairo_t and mask it uses
    to draw the opaque soft mask and attempts to destroy a reference to a
    surface it does not own (this bug was masked by the fact that a reference
    was still being held by the unfreed cairo_t).

diff --git a/poppler/CairoOutputDev.cc b/poppler/CairoOutputDev.cc
index 2c670b4..7dde30b 100644
--- a/poppler/CairoOutputDev.cc
+++ b/poppler/CairoOutputDev.cc
@@ -122,6 +122,8 @@ CairoOutputDev::~CairoOutputDev() {
   cairo_pattern_destroy (fill_pattern);
   if (group)
     cairo_pattern_destroy (group);
+  if (mask)
+    cairo_pattern_destroy (mask);
   if (shape)
     cairo_pattern_destroy (shape);
 }
@@ -818,6 +820,8 @@ static uint32_t luminocity(uint32_t x)
 /* XXX: do we need to deal with shape here? */
 void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha,
                                  Function * transferFunc, GfxColor * backdropColor) {
+  cairo_pattern_destroy(mask);
+
   if (alpha == false) {
     /* We need to mask according to the luminocity of the group.
      * So we paint the group to an image surface convert it to a luminocity map
@@ -855,6 +859,9 @@ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha,
     cairo_set_source(maskCtx, group);
     cairo_paint(maskCtx);
 
+    /* XXX status = cairo_status(maskCtx); */
+    cairo_destroy(maskCtx);
+
     /* convert to a luminocity map */
     uint32_t *source_data = (uint32_t*)cairo_image_surface_get_data(source);
     /* get stride in units of 32 bits */
@@ -884,10 +891,8 @@ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha,
     cairo_pattern_set_matrix(mask, &patMatrix);
 
     cairo_surface_destroy(source);
-    cairo_surface_destroy(pats);
   } else {
-    cairo_pattern_reference(group);
-    mask = group;
+    mask = cairo_pattern_reference(group);
   }
 
   popTransparencyGroup();