Workaround broken jpeg stream definitions

Bug #61994

4 files changed, 30 insertions, 10 deletions

diff --git a/poppler/DCTStream.cc b/poppler/DCTStream.cc
index 6302c8b6..decfd0f0 100644
--- a/poppler/DCTStream.cc
+++ b/poppler/DCTStream.cc
@@ -10,7 +10,7 @@
 // Copyright 2010 Carlos Garcia Campos <carlosgc@gnome.org>
 // Copyright 2011 Daiki Ueno <ueno@unixuser.org>
 // Copyright 2011 Tomas Hoger <thoger@redhat.com>
-// Copyright 2012 Thomas Freitag <Thomas.Freitag@alfa.de>
+// Copyright 2012, 2013 Thomas Freitag <Thomas.Freitag@alfa.de>
 //
 //========================================================================
 
@@ -60,9 +60,20 @@ static void str_term_source(j_decompress_ptr cinfo)
 {
 }
 
-DCTStream::DCTStream(Stream *strA, int colorXformA) :
+DCTStream::DCTStream(Stream *strA, int colorXformA, Object *dict) :
   FilterStream(strA) {
   colorXform = colorXformA;
+  if (dict != NULL) {
+    Object obj;
+
+    dict->dictLookup("Width", &obj);
+    err.width = (obj.isInt() && obj.getInt() <= JPEG_MAX_DIMENSION) ? obj.getInt() : 0;
+    obj.free();
+    dict->dictLookup("Height", &obj);
+    err.height = (obj.isInt() && obj.getInt() <= JPEG_MAX_DIMENSION) ? obj.getInt() : 0;
+    obj.free();
+  } else
+    err.height = err.width = 0;
   init();
 }
 
@@ -74,7 +85,12 @@ DCTStream::~DCTStream() {
 static void exitErrorHandler(jpeg_common_struct *error) {
   j_decompress_ptr cinfo = (j_decompress_ptr)error;
   str_error_mgr * err = (struct str_error_mgr *)cinfo->err;
-  longjmp(err->setjmp_buffer, 1);
+  if (cinfo->err->msg_code == JERR_IMAGE_TOO_BIG && err->width != 0 && err->height != 0) {
+    cinfo->image_height = err->height;
+    cinfo->image_width = err->width;
+  } else {
+    longjmp(err->setjmp_buffer, 1);
+  }
 }
 
 void DCTStream::init()
diff --git a/poppler/DCTStream.h b/poppler/DCTStream.h
index 55bd985d..7a566ced 100644
--- a/poppler/DCTStream.h
+++ b/poppler/DCTStream.h
@@ -9,6 +9,7 @@
 // Copyright 2005-2007, 2009-2011 Albert Astals Cid <aacid@kde.org>
 // Copyright 2010 Carlos Garcia Campos <carlosgc@gnome.org>
 // Copyright 2011 Daiki Ueno <ueno@unixuser.org>
+// Copyright 2013 Thomas Freitag <Thomas.Freitag@alfa.de>
 //
 //========================================================================
 
@@ -43,6 +44,7 @@
 
 extern "C" {
 #include <jpeglib.h>
+#include <jerror.h>
 }
 
 struct str_src_mgr {
@@ -55,12 +57,14 @@ struct str_src_mgr {
 struct str_error_mgr {
   struct jpeg_error_mgr pub;
   jmp_buf setjmp_buffer;
+  int width;
+  int height;
 };
 
 class DCTStream: public FilterStream {
 public:
 
-  DCTStream(Stream *strA, int colorXformA);
+  DCTStream(Stream *strA, int colorXformA, Object *dict);
   virtual ~DCTStream();
   virtual StreamKind getKind() { return strDCT; }
   virtual void reset();
diff --git a/poppler/Stream.cc b/poppler/Stream.cc
index 4cb3326e..964bfb7b 100644
--- a/poppler/Stream.cc
+++ b/poppler/Stream.cc
@@ -23,7 +23,7 @@
 // Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
 // Copyright (C) 2010 Tomas Hoger <thoger@redhat.com>
 // Copyright (C) 2011, 2012 William Bader <williambader@hotmail.com>
-// Copyright (C) 2012 Thomas Freitag <Thomas.Freitag@alfa.de>
+// Copyright (C) 2012, 2013 Thomas Freitag <Thomas.Freitag@alfa.de>
 // Copyright (C) 2012 Oliver Sander <sander@mi.fu-berlin.de>
 // Copyright (C) 2012 Fabio D'Urso <fabiodurso@hotmail.it>
 // Copyright (C) 2012 Even Rouault <even.rouault@mines-paris.org>
@@ -157,7 +157,7 @@ Stream *Stream::addFilters(Object *dict) {
     dict->dictLookup("DP", &params);
   }
   if (obj.isName()) {
-    str = makeFilter(obj.getName(), str, &params);
+    str = makeFilter(obj.getName(), str, &params, dict);
   } else if (obj.isArray()) {
     for (i = 0; i < obj.arrayGetLength(); ++i) {
       obj.arrayGet(i, &obj2);
@@ -183,7 +183,7 @@ Stream *Stream::addFilters(Object *dict) {
   return str;
 }
 
-Stream *Stream::makeFilter(char *name, Stream *str, Object *params) {
+Stream *Stream::makeFilter(char *name, Stream *str, Object *params, Object *dict) {
   int pred;			// parameters
   int colors;
   int bits;
@@ -284,7 +284,7 @@ Stream *Stream::makeFilter(char *name, Stream *str, Object *params) {
       }
       obj.free();
     }
-    str = new DCTStream(str, colorXform);
+    str = new DCTStream(str, colorXform, dict);
   } else if (!strcmp(name, "FlateDecode") || !strcmp(name, "Fl")) {
     pred = 1;
     columns = 1;
diff --git a/poppler/Stream.h b/poppler/Stream.h
index 20b5fd6d..7a5ff1cf 100644
--- a/poppler/Stream.h
+++ b/poppler/Stream.h
@@ -20,7 +20,7 @@
 // Copyright (C) 2009 Stefan Thomas <thomas@eload24.com>
 // Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
 // Copyright (C) 2011, 2012 William Bader <williambader@hotmail.com>
-// Copyright (C) 2012 Thomas Freitag <Thomas.Freitag@alfa.de>
+// Copyright (C) 2012, 2013 Thomas Freitag <Thomas.Freitag@alfa.de>
 // Copyright (C) 2012 Fabio D'Urso <fabiodurso@hotmail.it>
 //
 // To see a description of the changes please see the Changelog file that
@@ -224,7 +224,7 @@ private:
   virtual GBool hasGetChars() { return false; }
   virtual int getChars(int nChars, Guchar *buffer);
 
-  Stream *makeFilter(char *name, Stream *str, Object *params);
+  Stream *makeFilter(char *name, Stream *str, Object *params, Object *dict = NULL);
 
   int ref;			// reference count
 };