[gs-commits] rev 11600 - trunk/gs/base

[ken at ghostscript.com]

Author: ken
Date: 2010-08-05 15:49:39 +0000 (Thu, 05 Aug 2010)
New Revision: 11600

Modified:
   trunk/gs/base/gdevpdte.c
Log:
Fix (pdfwrite) 
A piece of data (pointer to glyph data) was stored and passed into a routine
'process_text_modify_width' which expected the glyph data to remain unchanged but
modified the text enumerator data. This doesn't work if the glyph data is a pointer
to the text enumerator data. NB the text enumerator is saved and restored around the
call.

Modified so that the calling routine makes a copy of the glyph data before calling 
'process_text_modify_width'.

This should prevent 13-10.ps from entering an infinite loop.


Modified: trunk/gs/base/gdevpdte.c
===================================================================
--- trunk/gs/base/gdevpdte.c	2010-08-04 23:15:24 UTC (rev 11599)
+++ trunk/gs/base/gdevpdte.c	2010-08-05 15:49:39 UTC (rev 11600)
@@ -563,6 +563,15 @@
 	gs_text_params_t text = penum->text;
 	int xy_index_step = (!(penum->text.operation & TEXT_REPLACE_WIDTHS) ? 0 :
 			     penum->text.x_widths == penum->text.y_widths ? 2 : 1);
+	/* process_text_modify_width also modifies penum->text.data, but calls
+	 * routines which rely on gdata. Copy gdata here (if set) to prevent
+	 * corruption if gdata is pointing at penum->text->data.glyphs
+	 */
+	gs_glyph gdata_i, gdata_p = 0x00;
+	if (gdata) {
+	    gdata_i = *gdata;
+	    gdata_p = &gdata_i;
+	}
 	
 	if (penum->text.operation & TEXT_REPLACE_WIDTHS) {
 	    if (penum->text.x_widths != NULL)
@@ -573,7 +582,7 @@
 	penum->xy_index = 0;
 	code = process_text_modify_width(penum, (gs_font *)font, ppts,
 					 (gs_const_string *)pstr,
-					 &width_pt, gdata, false);
+					 &width_pt, gdata_p, false);
 	if (penum->text.operation & TEXT_REPLACE_WIDTHS) {
 	    if (penum->text.x_widths != NULL)
 		penum->text.x_widths -= xy_index * xy_index_step;