[poppler] poppler/Gfx.cc

[Albert Astals Cid]

 poppler/Gfx.cc |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

New commits:
commit e0fb18040378659c98fedb4bdaff6a903ddd095b
Author: Albert Astals Cid <aacid at kde.org>
Date:   Wed May 23 19:40:50 2018 +0200

    Gfx::opSetExtGState: Fix memory leak on broken files
    
    doSoftMask was called just once, from opSetExtGState, but was
    given the duty to delete blendingColorSpace that given doSoftMask
    has various early returns is hard to do right, so i've moved
    the deletion to opSetExtGState itself
    
    fixes oss-fuzz/8431

diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc
index af6fb9bd..f7cea495 100644
--- a/poppler/Gfx.cc
+++ b/poppler/Gfx.cc
@@ -989,7 +989,6 @@ void Gfx::opSetExtGState(Object args[], int numArgs) {
   Function *funcs[4];
   GfxColor backdropColor;
   GBool haveBackdropColor;
-  GfxColorSpace *blendingColorSpace;
   GBool alpha, isolated, knockout;
   double opac;
   int i;
@@ -1196,7 +1195,7 @@ void Gfx::opSetExtGState(Object args[], int numArgs) {
       if (obj3.isStream()) {
 	Object obj4 = obj3.streamGetDict()->lookup("Group");
 	if (obj4.isDict()) {
-	  blendingColorSpace = nullptr;
+	  GfxColorSpace *blendingColorSpace = nullptr;
 	  isolated = knockout = gFalse;
 	  Object obj5 = obj4.dictLookup("CS");
 	  if (!obj5.isNull()) {
@@ -1222,6 +1221,7 @@ void Gfx::opSetExtGState(Object args[], int numArgs) {
 	  }
 	  doSoftMask(&obj3, alpha, blendingColorSpace,
 		     isolated, knockout, funcs[0], &backdropColor);
+	  delete blendingColorSpace;
 	} else {
 	  error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group");
 	}
@@ -1354,10 +1354,6 @@ void Gfx::doSoftMask(Object *str, GBool alpha,
 	  blendingColorSpace, isolated, knockout,
 	  alpha, transferFunc, backdropColor);
   --formDepth;
-
-  if (blendingColorSpace) {
-    delete blendingColorSpace;
-  }
 }
 
 void Gfx::opSetRenderingIntent(Object args[], int numArgs) {