From 1f86ebaac605b62901bd103b1f23b53979acc5a4 Mon Sep 17 00:00:00 2001
From: Matthias Kramm <kramm@quiss.org>
Date: Tue, 25 Aug 2009 19:20:58 +0200
Subject: [PATCH] fixed bug in swf->pdf part of rendering pipeline

---
 lib/devices/pdf.c     |    2 +-
 lib/modules/swfbits.c |    3 ++-
 lib/readers/swf.c     |    9 +++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/devices/pdf.c b/lib/devices/pdf.c
index 4d223c8..c1e1bb6 100644
--- a/lib/devices/pdf.c
+++ b/lib/devices/pdf.c
@@ -205,9 +205,9 @@ void pdf_drawchar(gfxdevice_t*dev, gfxfont_t*font, int glyphnr, gfxcolor_t*color
     char as_shape = 0;
     if(!type3) as_shape=1;
     if(glyphnr>256-32) as_shape=1;
-    gfxmatrix_dump(matrix, stdout, "");
     if(fabs(matrix->m00 + matrix->m11) > 0.01) as_shape=1;
     if(fabs(fabs(matrix->m01) + fabs(matrix->m10)) > 0.01) as_shape=1;
+    if(fabs(matrix->m00) < 0.01) as_shape=1;
 
     if(as_shape) {
 	gfxline_t*line2 = gfxline_clone(glyph->line);
diff --git a/lib/modules/swfbits.c b/lib/modules/swfbits.c
index 88ba8b9..4fa38f5 100644
--- a/lib/modules/swfbits.c
+++ b/lib/modules/swfbits.c
@@ -561,7 +561,8 @@ static void tag_init_source(struct jpeg_decompress_struct *cinfo)
 static boolean tag_fill_input_buffer(struct jpeg_decompress_struct *cinfo)
 {
     TAG *tag = (TAG *) cinfo->client_data;
-    if (tag->data[tag->pos + 0] == 0xff &&
+    if (tag->pos + 4 <= tag->len &&
+	tag->data[tag->pos + 0] == 0xff &&
 	tag->data[tag->pos + 1] == 0xd9 &&
 	tag->data[tag->pos + 2] == 0xff &&
 	tag->data[tag->pos + 3] == 0xd8) {
diff --git a/lib/readers/swf.c b/lib/readers/swf.c
index da6d6ae..132bf84 100644
--- a/lib/readers/swf.c
+++ b/lib/readers/swf.c
@@ -1,3 +1,4 @@
+#include <stdlib.h>
 #include <assert.h>
 #include "../gfxdevice.h"
 #include "../gfxsource.h"
@@ -698,12 +699,20 @@ gfxdocument_t*swf_open(gfxsource_t*src, const char*filename)
     return swf_doc;
 }
 
+static void swf_destroy(gfxsource_t*src)
+{
+    memset(src, 0, sizeof(*src));
+    free(src);
+}
+
+
 gfxsource_t*gfxsource_swf_create()
 {
     gfxsource_t*src = (gfxsource_t*)malloc(sizeof(gfxsource_t));
     memset(src, 0, sizeof(gfxsource_t));
     src->set_parameter = swf_set_parameter;
     src->open = swf_open;
+    src->destroy = swf_destroy;
     return src;
 }
 
-- 
1.7.10.4