[poppler] 2 commits - poppler/Gfx.cc

[Albert Astals Cid]

 poppler/Gfx.cc |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

New commits:
commit 0b1cd9403b8a240e58ec4f1832588d25f8295278
Author: Jason Crain <jason at aquaticape.us>
Date:   Sat Dec 20 03:22:23 2014 -0600

    Free BBox object on error

diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc
index 77693f9..6ad1b2c 100644
--- a/poppler/Gfx.cc
+++ b/poppler/Gfx.cc
@@ -5278,6 +5278,7 @@ void Gfx::drawAnnot(Object *str, AnnotBorder *border, AnnotColor *aColor,
         obj1.free();
       } else {
         obj1.free();
+        bboxObj.free();
         error(errSyntaxError, getPos(), "Bad form bounding box value");
         return;
       }
commit acc33a6950031ac4a5c759d043d24df0cfa7e8b6
Author: Jason Crain <jason at aquaticape.us>
Date:   Sat Dec 20 02:24:49 2014 -0600

    Check for invalid matrix in annotation
    
    Bug #84990

diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc
index 64a9d7b..77693f9 100644
--- a/poppler/Gfx.cc
+++ b/poppler/Gfx.cc
@@ -37,6 +37,7 @@
 // Copyright (C) 2012 Even Rouault <even.rouault at mines-paris.org>
 // Copyright (C) 2012, 2013 Fabio D'Urso <fabiodurso at hotmail.it>
 // Copyright (C) 2012 Lu Wang <coolwanglu at gmail.com>
+// Copyright (C) 2014 Jason Crain <jason at aquaticape.us>
 //
 // To see a description of the changes please see the Changelog file that
 // came with your tarball or type make ChangeLog if you are building from git
@@ -5288,8 +5289,15 @@ void Gfx::drawAnnot(Object *str, AnnotBorder *border, AnnotColor *aColor,
     if (matrixObj.isArray() && matrixObj.arrayGetLength() >= 6) {
       for (i = 0; i < 6; ++i) {
 	matrixObj.arrayGet(i, &obj1);
-	m[i] = obj1.getNum();
-	obj1.free();
+	if (likely(obj1.isNum())) {
+	  m[i] = obj1.getNum();
+	  obj1.free();
+	} else {
+	  obj1.free();
+	  matrixObj.free();
+	  error(errSyntaxError, getPos(), "Bad form matrix");
+	  return;
+	}
       }
     } else {
       m[0] = 1; m[1] = 0;