Do not crash in broken documents like 1007.pdf.asan.48.4

1 files changed, 11 insertions, 1 deletions

diff --git a/splash/Splash.cc b/splash/Splash.cc
index 336872b2..2e3687ad 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -2951,12 +2951,17 @@ void Splash::arbitraryTransformMask(SplashImageMaskSource src, void *srcData,
   ir10 = -r10 / det;
   ir11 = r00 / det;
 
   // scale the input image
   scaledMask = scaleMask(src, srcData, srcWidth, srcHeight,
 			 scaledWidth, scaledHeight);
+  if (scaledMask->data == NULL) {
+    error(errInternal, -1, "scaledMask->data is NULL in Splash::scaleMaskYuXu");
+    delete scaledMask;
+    return;
+  }
 
   // construct the three sections
   i = (vy[2] <= vy[3]) ? 2 : 3;
   if (vy[1] <= vy[i]) {
     i = 1;
   }
@@ -3378,12 +3383,18 @@ void Splash::scaleMaskYuXu(SplashImageMaskSource src, void *srcData,
   Guchar *lineBuf;
   Guint pix;
   Guchar *destPtr0, *destPtr;
   int yp, yq, xp, xq, yt, y, yStep, xt, x, xStep, xx;
   int i, j;
 
+  destPtr0 = dest->data;
+  if (destPtr0 == NULL) {
+    error(errInternal, -1, "dest->data is NULL in Splash::scaleMaskYuXu");
+    return;
+  }
+
   // Bresenham parameters for y scale
   yp = scaledHeight / srcHeight;
   yq = scaledHeight % srcHeight;
 
   // Bresenham parameters for x scale
   xp = scaledWidth / srcWidth;
@@ -3392,13 +3403,12 @@ void Splash::scaleMaskYuXu(SplashImageMaskSource src, void *srcData,
   // allocate buffers
   lineBuf = (Guchar *)gmalloc(srcWidth);
 
   // init y scale Bresenham
   yt = 0;
 
-  destPtr0 = dest->data;
   for (y = 0; y < srcHeight; ++y) {
 
     // y scale Bresenham
     if ((yt += yq) >= srcHeight) {
       yt -= srcHeight;
       yStep = yp + 1;