fixed bug in swf->pdf part of rendering pipeline

[swftools.git] / lib / modules / swfbits.c

diff --git a/lib/modules/swfbits.c b/lib/modules/swfbits.c
index 4f6b310..4fa38f5 100644 (file)
--- a/lib/modules/swfbits.c
+++ b/lib/modules/swfbits.c
@@ -561,7 +561,8 @@ static void tag_init_source(struct jpeg_decompress_struct *cinfo)
 static boolean tag_fill_input_buffer(struct jpeg_decompress_struct *cinfo)
 {
     TAG *tag = (TAG *) cinfo->client_data;
-    if (tag->data[tag->pos + 0] == 0xff &&
+    if (tag->pos + 4 <= tag->len &&
+       tag->data[tag->pos + 0] == 0xff &&
        tag->data[tag->pos + 1] == 0xd9 &&
        tag->data[tag->pos + 2] == 0xff &&
        tag->data[tag->pos + 3] == 0xd8) {
@@ -1399,12 +1400,12 @@ static void blurImage(RGBA*src, int width, int height, int r)
     }
     int range = r*e/2;
 
-    RGBA*dest = malloc(sizeof(RGBA)*width*height);
+    RGBA*tmp = malloc(sizeof(RGBA)*width*height);
 
     int y;
     for(y=0;y<height;y++) {
         RGBA*s = &src[y*width];
-        RGBA*d = &dest[y*width];
+        RGBA*d = &tmp[y*width];
         for(x=0;x<range;x++) {
             d[x] = s[x];
         }
@@ -1432,11 +1433,9 @@ static void blurImage(RGBA*src, int width, int height, int r)
         }
     }
 
-    memcpy(src, dest, width*height*sizeof(RGBA));
-
     for(x=0;x<width;x++) {
-        RGBA*s = &src[x];
-        RGBA*d = &dest[x];
+        RGBA*s = &tmp[x];
+        RGBA*d = &src[x];
         int yy=0;
         for(y=0;y<range;y++) {
             d[yy] = s[yy];
@@ -1468,9 +1467,8 @@ static void blurImage(RGBA*src, int width, int height, int r)
             yy += width;
         }
     }
-    memcpy(src, dest, width*height*sizeof(RGBA));
 
-    free(dest);
+    free(tmp);
     free(weights);
     free(gauss);
 }