Coverage Report

Created: 2026-04-09 07:06

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ghostpdl/pdf/pdf_func.c
Line
Count
Source
1
/* Copyright (C) 2018-2026 Artifex Software, Inc.
2
   All Rights Reserved.
3
4
   This software is provided AS-IS with no warranty, either express or
5
   implied.
6
7
   This software is distributed under license and may not be copied,
8
   modified or distributed except as expressly authorized under the terms
9
   of the license contained in the file LICENSE in this distribution.
10
11
   Refer to licensing information at http://www.artifex.com or contact
12
   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,
13
   CA 94129, USA, for further information.
14
*/
15
16
/* function creation for the PDF interpreter */
17
18
#include "pdf_int.h"
19
#include "pdf_stack.h"
20
#include "pdf_func.h"
21
#include "pdf_dict.h"
22
#include "pdf_array.h"
23
#include "pdf_file.h"
24
#include "pdf_loop_detect.h"
25
26
#include "gsdsrc.h"
27
#include "gsfunc0.h"
28
#include "gsfunc3.h"
29
#include "gsfunc4.h"
30
#include "stream.h"
31
32
static int pdfi_build_sub_function(pdf_context *ctx, gs_function_t ** ppfn, const float *shading_domain, int num_inputs, pdf_obj *stream_obj, pdf_dict *page_dict);
33
34
1.38M
#define NUMBERTOKENSIZE 16
35
6.09M
#define OPTOKENSIZE 9
36
#define TOKENBUFFERSIZE NUMBERTOKENSIZE + 1
37
#define NUMOPS 42
38
39
typedef struct op_struct {
40
    unsigned char length;
41
    gs_PtCr_opcode_t code;
42
    unsigned char op[8];
43
}op_struct_t;
44
45
static const op_struct_t ops_table[] = {
46
    {(unsigned char)2, PtCr_eq, "eq"},
47
    {(unsigned char)2, PtCr_ge, "ge"},
48
    {(unsigned char)2, PtCr_gt, "gt"},
49
    {(unsigned char)2, PtCr_if, "if"},
50
    {(unsigned char)2, PtCr_le, "le"},
51
    {(unsigned char)2, PtCr_ln, "ln"},
52
    {(unsigned char)2, PtCr_lt, "lt"},
53
    {(unsigned char)2, PtCr_ne, "ne"},
54
    {(unsigned char)2, PtCr_or, "or"},
55
56
    {(unsigned char)3, PtCr_abs, "abs"},
57
    {(unsigned char)3, PtCr_add, "add"},
58
    {(unsigned char)3, PtCr_and, "and"},
59
    {(unsigned char)3, PtCr_cos, "cos"},
60
    {(unsigned char)3, PtCr_cvi, "cvi"},
61
    {(unsigned char)3, PtCr_cvr, "cvr"},
62
    {(unsigned char)3, PtCr_div, "div"},
63
    {(unsigned char)3, PtCr_dup, "dup"},
64
    {(unsigned char)3, PtCr_exp, "exp"},
65
    {(unsigned char)3, PtCr_log, "log"},
66
    {(unsigned char)3, PtCr_mul, "mul"},
67
    {(unsigned char)3, PtCr_mod, "mod"},
68
    {(unsigned char)3, PtCr_neg, "neg"},
69
    {(unsigned char)3, PtCr_not, "not"},
70
    {(unsigned char)3, PtCr_pop, "pop"},
71
    {(unsigned char)3, PtCr_sin, "sin"},
72
    {(unsigned char)3, PtCr_sub, "sub"},
73
    {(unsigned char)3, PtCr_xor, "xor"},
74
75
    {(unsigned char)4, PtCr_atan, "atan"},
76
    {(unsigned char)4, PtCr_copy, "copy"},
77
    {(unsigned char)4, PtCr_exch, "exch"},
78
    {(unsigned char)4, PtCr_idiv, "idiv"},
79
    {(unsigned char)4, PtCr_roll, "roll"},
80
    {(unsigned char)4, PtCr_sqrt, "sqrt"},
81
    {(unsigned char)4, PtCr_true, "true"},
82
83
    {(unsigned char)5, PtCr_false, "false"},
84
    {(unsigned char)5, PtCr_floor, "floor"},
85
    {(unsigned char)5, PtCr_index, "index"},
86
    {(unsigned char)5, PtCr_round, "round"},
87
88
    {(unsigned char)6, PtCr_else, "ifelse"},
89
90
    {(unsigned char)7, PtCr_ceiling, "ceiling"},
91
92
    {(unsigned char)8, PtCr_bitshift, "bitshift"},
93
    {(unsigned char)8, PtCr_truncate, "truncate"},
94
};
95
96
/* Fix up an if or ifelse forward reference. */
97
static int
98
psc_fixup(byte *p, byte *to)
99
79.9k
{
100
79.9k
    int skip = to - (p + 3);
101
102
79.9k
    if (skip > 0xFFFF)
103
0
        return_error(gs_error_rangecheck);
104
105
79.9k
    p[1] = (byte)(skip >> 8);
106
79.9k
    p[2] = (byte)skip;
107
79.9k
    return 0;
108
79.9k
}
109
static int
110
psc_fixup_ifelse(byte *p)
111
39.6k
{
112
39.6k
    int iflen = (p[0] << 8) + p[1];
113
114
39.6k
    iflen += 3;         /* To skip past the 'if' body and the 'else' header */
115
39.6k
    if (iflen > 0xFFFF)
116
0
        return_error(gs_error_rangecheck);
117
118
39.6k
    p[0] = (byte)(iflen >> 8);
119
39.6k
    p[1] = (byte)iflen;
120
39.6k
    return 0;
121
39.6k
}
122
123
/* Store an int in the  buffer */
124
static int
125
936k
put_int(byte **p, int n) {
126
936k
   if (n == (byte)n) {
127
851k
       if (*p) {
128
425k
          (*p)[0] = PtCr_byte;
129
425k
          (*p)[1] = (byte)n;
130
425k
          *p += 2;
131
425k
       }
132
851k
       return 2;
133
851k
   } else {
134
85.0k
       if (*p) {
135
42.4k
          **p = PtCr_int;
136
42.4k
          memcpy(*p + 1, &n, sizeof(int));
137
42.4k
          *p += sizeof(int) + 1;
138
42.4k
       }
139
85.0k
       return (sizeof(int) + 1);
140
85.0k
   }
141
936k
}
142
143
/* Store a float in the  buffer */
144
static int
145
242k
put_float(byte **p, float n) {
146
242k
   if (*p) {
147
121k
      **p = PtCr_float;
148
121k
      memcpy(*p + 1, &n, sizeof(float));
149
121k
      *p += sizeof(float) + 1;
150
121k
   }
151
242k
   return (sizeof(float) + 1);
152
242k
}
153
154
static int
155
pdfi_parse_type4_func_stream(pdf_context *ctx, pdf_c_stream *function_stream, int depth, byte *ops, unsigned int *size)
156
263k
{
157
263k
    int code;
158
263k
    int c;
159
263k
    char TokenBuffer[TOKENBUFFERSIZE];
160
263k
    unsigned int Size, IsReal;
161
263k
    byte *clause = NULL;
162
263k
    byte *p = (ops ? ops + *size : NULL);
163
164
8.95M
    while (1) {
165
8.95M
        if (*size > max_uint / 2)
166
0
            return gs_note_error(gs_error_VMerror);
167
168
8.95M
        c = pdfi_read_byte(ctx, function_stream);
169
8.95M
        if (c < 0)
170
114
            break;
171
8.95M
        switch(c) {
172
29
            case '%':
173
1.37k
                do {
174
1.37k
                    c = pdfi_read_byte(ctx, function_stream);
175
1.37k
                    if (c < 0)
176
12
                        break;
177
1.36k
                    if (c == 0x0a || c == 0x0d)
178
17
                        break;
179
1.36k
                }while (1);
180
29
                break;
181
4.61M
            case 0x20:
182
4.69M
            case 0x0a:
183
4.69M
            case 0x0d:
184
4.69M
            case 0x09:
185
4.69M
                continue;
186
263k
            case '{':
187
263k
                if (depth == 0) {
188
102k
                    depth++;
189
160k
                } else {
190
                    /* recursion, move on 3 bytes, and parse the sub level */
191
160k
                    if (depth == MAX_PSC_FUNCTION_NESTING)
192
0
                        return_error (gs_error_syntaxerror);
193
160k
                    *size += 3;
194
160k
                    code = pdfi_parse_type4_func_stream(ctx, function_stream, depth + 1, ops, size);
195
160k
                    if (code < 0)
196
160
                        return code;
197
159k
                    if (p) {
198
79.9k
                        if (clause == NULL) {
199
40.2k
                            clause = p;
200
40.2k
                            *p = (byte)PtCr_if;
201
40.2k
                            if ((code = psc_fixup(p, ops + *size)) < 0)
202
0
                                return code;
203
40.2k
                        } else {
204
39.6k
                            *p = (byte)PtCr_else;
205
39.6k
                            if ((code = psc_fixup(p, ops + *size)) < 0 ||
206
39.6k
                                (code = psc_fixup_ifelse(clause + 1) < 0))
207
0
                                return code;
208
39.6k
                            clause = NULL;
209
39.6k
                        }
210
79.9k
                        p = ops + *size;
211
79.9k
                    }
212
159k
                }
213
262k
                break;
214
262k
            case '}':
215
262k
                return *size;
216
0
                break;
217
3.73M
            default:
218
3.73M
                if (clause != NULL)
219
540
                    clause = NULL;
220
3.73M
                if ((c >= '0' && c <= '9') || c == '-' || c == '.') {
221
                    /* parse a number */
222
1.17M
                    Size = 1;
223
1.17M
                    if (c == '.')
224
197
                        IsReal = 1;
225
1.17M
                    else
226
1.17M
                        IsReal = 0;
227
1.17M
                    TokenBuffer[0] = (byte)c;
228
2.56M
                    while (1) {
229
2.56M
                        c = pdfi_read_byte(ctx, function_stream);
230
2.56M
                        if (c < 0)
231
0
                            return_error(gs_error_syntaxerror);
232
233
2.56M
                        if (c == '.'){
234
242k
                            if (IsReal == 1)
235
20
                                return_error(gs_error_syntaxerror);
236
242k
                            else {
237
242k
                                TokenBuffer[Size++] = (byte)c;
238
242k
                                IsReal = 1;
239
242k
                            }
240
2.32M
                        } else {
241
2.32M
                            if (c >= '0' && c <= '9') {
242
1.14M
                                TokenBuffer[Size++] = (byte)c;
243
1.14M
                            } else
244
1.17M
                                break;
245
2.32M
                        }
246
1.38M
                        if (Size > NUMBERTOKENSIZE) {
247
203
                            if (IsReal == 1)
248
                                /* Just discard decimal places beyond NUMBERTOKENSIZE .... */
249
203
                                Size--;
250
0
                            else
251
0
                                return_error(gs_error_syntaxerror);
252
203
                        }
253
1.38M
                    }
254
1.17M
                    TokenBuffer[Size] = 0x00;
255
1.17M
                    pdfi_unread_byte(ctx, function_stream, (byte)c);
256
1.17M
                    if (IsReal == 1) {
257
242k
                        *size += put_float(&p, atof(TokenBuffer));
258
936k
                    } else {
259
936k
                        *size += put_int(&p, atoi(TokenBuffer));
260
936k
                    }
261
2.55M
                } else {
262
2.55M
                    int i, NumOps = sizeof(ops_table) / sizeof(op_struct_t);
263
2.55M
                    op_struct_t *Op;
264
265
                    /* parse an operator */
266
2.55M
                    Size = 1;
267
2.55M
                    TokenBuffer[0] = (byte)c;
268
8.64M
                    while (1) {
269
8.64M
                        c = pdfi_read_byte(ctx, function_stream);
270
8.64M
                        if (c < 0)
271
54
                            return_error(gs_error_syntaxerror);
272
8.64M
                        if (c == 0x20 || c == 0x09 || c == 0x0a || c == 0x0d || c == '{' || c == '}')
273
2.55M
                            break;
274
6.09M
                        TokenBuffer[Size++] = (byte)c;
275
6.09M
                        if (Size > OPTOKENSIZE)
276
88
                            return_error(gs_error_syntaxerror);
277
6.09M
                    }
278
2.55M
                    TokenBuffer[Size] = 0x00;
279
2.55M
                    pdfi_unread_byte(ctx, function_stream, (byte)c);
280
57.4M
                    for (i=0;i < NumOps;i++) {
281
57.4M
                        Op = (op_struct_t *)&ops_table[i];
282
57.4M
                        if (Op->length < Size)
283
39.0M
                            continue;
284
285
18.3M
                        if (Op->length > Size)
286
190
                            return_error(gs_error_undefined);
287
288
18.3M
                        if (memcmp(Op->op, TokenBuffer, Size) == 0)
289
2.55M
                            break;
290
18.3M
                    }
291
2.55M
                    if (i > NumOps)
292
0
                        return_error(gs_error_syntaxerror);
293
2.55M
                    if (p == NULL)
294
1.27M
                        (*size)++;
295
1.27M
                    else {
296
1.27M
                        if (Op->code != PtCr_else && Op->code != PtCr_if) {
297
1.23M
                            (*size)++;
298
1.23M
                            *p++ = Op->code;
299
1.23M
                        }
300
1.27M
                    }
301
2.55M
                }
302
3.73M
                break;
303
8.95M
        }
304
8.95M
    }
305
306
114
    return 0;
307
263k
}
308
309
static int
310
pdfi_build_function_4(pdf_context *ctx, gs_function_params_t * mnDR,
311
                    pdf_stream *function_obj, int depth, gs_function_t ** ppfn)
312
12.0k
{
313
12.0k
    gs_function_PtCr_params_t params;
314
12.0k
    pdf_c_stream *function_stream = NULL;
315
12.0k
    int code;
316
12.0k
    byte *data_source_buffer;
317
12.0k
    byte *ops = NULL;
318
12.0k
    unsigned int size;
319
320
12.0k
    memset(&params, 0x00, sizeof(gs_function_PtCr_params_t));
321
12.0k
    *(gs_function_params_t *)&params = *mnDR;
322
12.0k
    params.ops.data = 0;  /* in case of failure */
323
12.0k
    params.ops.size = 0;  /* ditto */
324
325
12.0k
    if (pdfi_type_of(function_obj) != PDF_STREAM)
326
37
        return_error(gs_error_undefined);
327
328
12.0k
    code = pdfi_open_memory_stream_from_filtered_stream(ctx, function_obj, &data_source_buffer, &function_stream, false);
329
12.0k
    if (code < 0)
330
26
        goto function_4_error;
331
332
12.0k
    size = 0;
333
12.0k
    code = pdfi_parse_type4_func_stream(ctx, function_stream, 0, NULL, &size);
334
12.0k
    if (code < 0)
335
352
        goto function_4_error;
336
337
11.6k
    if (size > max_uint - 1) {
338
0
        code = gs_note_error(gs_error_VMerror);
339
0
        goto function_4_error;
340
0
    }
341
342
11.6k
    ops = gs_alloc_string(ctx->memory, size + 1, "pdfi_build_function_4(ops)");
343
11.6k
    if (ops == NULL) {
344
0
        code = gs_error_VMerror;
345
0
        goto function_4_error;
346
0
    }
347
348
11.6k
    code = pdfi_seek(ctx, function_stream, 0, SEEK_SET);
349
11.6k
    if (code < 0)
350
0
        goto function_4_error;
351
352
11.6k
    size = 0;
353
11.6k
    code = pdfi_parse_type4_func_stream(ctx, function_stream, 0, ops, &size);
354
11.6k
    if (code < 0)
355
0
        goto function_4_error;
356
11.6k
    ops[size] = PtCr_return;
357
358
11.6k
    code = pdfi_close_memory_stream(ctx, data_source_buffer, function_stream);
359
11.6k
    function_stream = NULL;
360
11.6k
    if (code < 0)
361
0
        goto function_4_error;
362
363
11.6k
    params.ops.data = (const byte *)ops;
364
    /* ops will now be freed with the function params, NULL ops now to avoid double free on error */
365
11.6k
    ops = NULL;
366
11.6k
    params.ops.size = size + 1;
367
11.6k
    code = gs_function_PtCr_init(ppfn, &params, ctx->memory);
368
11.6k
    if (code < 0)
369
27
        goto function_4_error;
370
371
11.6k
    return 0;
372
373
405
function_4_error:
374
405
    if (function_stream)
375
352
        (void)pdfi_close_memory_stream(ctx, data_source_buffer, function_stream);
376
377
405
    gs_function_PtCr_free_params(&params, ctx->memory);
378
405
    if (ops)
379
0
        gs_free_const_string(ctx->memory, ops, size, "pdfi_build_function_4(ops)");
380
405
    mnDR->Range = NULL;
381
405
    mnDR->Domain = NULL;
382
405
    return code;
383
11.6k
}
384
385
static int
386
pdfi_build_function_0(pdf_context *ctx, gs_function_params_t * mnDR,
387
                    pdf_stream *function_obj, int depth, gs_function_t ** ppfn)
388
17.5k
{
389
17.5k
    gs_function_Sd_params_t params;
390
17.5k
    pdf_c_stream *function_stream = NULL;
391
17.5k
    int code = 0;
392
17.5k
    int64_t Length, temp;
393
17.5k
    byte *data_source_buffer;
394
17.5k
    pdf_dict *function_dict = NULL;
395
396
17.5k
    memset(&params, 0x00, sizeof(gs_function_params_t));
397
17.5k
    *(gs_function_params_t *) & params = *mnDR;
398
17.5k
    params.Encode = params.Decode = NULL;
399
17.5k
    params.pole = NULL;
400
17.5k
    params.Size = params.array_step = params.stream_step = NULL;
401
17.5k
    params.Order = 0;
402
403
17.5k
    if (pdfi_type_of(function_obj) != PDF_STREAM)
404
12
        return_error(gs_error_undefined);
405
406
17.5k
    code = pdfi_dict_from_obj(ctx, (pdf_obj *)function_obj, &function_dict);
407
17.5k
    if (code < 0)
408
0
        return code;
409
410
17.5k
    Length = pdfi_open_memory_stream_from_filtered_stream(ctx, function_obj, &data_source_buffer, &function_stream, false);
411
17.5k
    if (Length < 0) {
412
90
        return Length;
413
90
    }
414
415
17.4k
    data_source_init_stream(&params.DataSource, function_stream->s);
416
417
    /* We need to clear up the PDF stream, but leave the underlying stream alone, that's now
418
     * pointed to by the params.DataSource member.
419
     */
420
17.4k
    gs_free_object(ctx->memory, function_stream, "discard memory stream(pdf_stream)");
421
422
17.4k
    code = pdfi_dict_get_int(ctx, function_dict, "Order", &temp);
423
17.4k
    if (code < 0 &&  code != gs_error_undefined)
424
0
        goto function_0_error;
425
17.4k
    if (code == gs_error_undefined)
426
16.3k
        params.Order = 1;
427
1.11k
    else
428
1.11k
        params.Order = (int)temp;
429
430
17.4k
    code = pdfi_dict_get_int(ctx, function_dict, "BitsPerSample", &temp);
431
17.4k
    if (code < 0)
432
203
        goto function_0_error;
433
17.2k
    params.BitsPerSample = temp;
434
435
17.2k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Encode, function_dict, "Encode");
436
17.2k
    if (code < 0) {
437
5.52k
        if (code == gs_error_undefined)
438
5.52k
            code = 2 * params.m;
439
4
        else
440
4
            goto function_0_error;
441
5.52k
    }
442
17.2k
    if (code != 2 * params.m) {
443
0
        code = gs_error_rangecheck;
444
0
        goto function_0_error;
445
0
    }
446
447
17.2k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Decode, function_dict, "Decode");
448
17.2k
    if (code < 0) {
449
5.55k
        if (code == gs_error_undefined)
450
5.51k
            code = 2 * params.n;
451
42
        else
452
42
            goto function_0_error;
453
5.55k
    }
454
17.1k
    if (code != 2 * params.n) {
455
15
        code = gs_error_rangecheck;
456
15
        goto function_0_error;
457
15
    }
458
459
17.1k
    code = pdfi_make_int_array_from_dict(ctx, (int **)&params.Size, function_dict, "Size");
460
17.1k
    if (code != params.m) {
461
116
        if (code >= 0)
462
26
            code = gs_error_rangecheck;
463
116
        goto function_0_error;
464
116
    }
465
    /* check the stream has enough data */
466
17.0k
    {
467
17.0k
        unsigned int i;
468
17.0k
        uint64_t inputs = 1, samples = 0;
469
470
35.0k
        for (i=0;i<params.m;i++) {
471
17.9k
            inputs *= params.Size[i];
472
17.9k
        }
473
17.0k
        samples = params.n * (uint64_t)params.BitsPerSample;
474
17.0k
        samples *= inputs;
475
17.0k
        samples = samples >> 3;
476
17.0k
        if (samples > Length) {
477
298
            code = gs_error_rangecheck;
478
298
            goto function_0_error;
479
298
        }
480
17.0k
    }
481
482
16.7k
    code = gs_function_Sd_init(ppfn, &params, ctx->memory);
483
16.7k
    if (code < 0)
484
243
        goto function_0_error;
485
16.5k
    return 0;
486
487
921
function_0_error:
488
921
    s_close_filters(&params.DataSource.data.strm, params.DataSource.data.strm->strm);
489
921
    params.DataSource.data.strm = NULL;
490
921
    gs_function_Sd_free_params(&params, ctx->memory);
491
    /* These are freed by gs_function_Sd_free_params, since we copied
492
     * the poitners, we must NULL the originals, so that we don't double free.
493
     */
494
921
    mnDR->Range = NULL;
495
921
    mnDR->Domain = NULL;
496
921
    return code;
497
16.7k
}
498
499
static int
500
pdfi_build_function_2(pdf_context *ctx, gs_function_params_t * mnDR,
501
                    pdf_dict *function_dict, int depth, gs_function_t ** ppfn)
502
81.1k
{
503
81.1k
    gs_function_ElIn_params_t params;
504
81.1k
    int code, n0, n1;
505
81.1k
    double temp = 0.0;
506
507
81.1k
    memset(&params, 0x00, sizeof(gs_function_params_t));
508
81.1k
    *(gs_function_params_t *)&params = *mnDR;
509
81.1k
    params.C0 = 0;
510
81.1k
    params.C1 = 0;
511
512
81.1k
    code = pdfi_dict_get_number(ctx, function_dict, "N", &temp);
513
81.1k
    if (code < 0 &&  code != gs_error_undefined)
514
0
        return code;
515
81.1k
    params.N = (float)temp;
516
517
81.1k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.C0, function_dict, "C0");
518
81.1k
    if (code < 0 && code != gs_error_undefined)
519
46
        return code;
520
81.1k
    n0 = code;
521
522
81.1k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.C1, function_dict, "C1");
523
81.1k
    if (code < 0 && code != gs_error_undefined)
524
9
        goto function_2_error;
525
526
81.1k
    n1 = code;
527
81.1k
    if (params.C0 == NULL)
528
20
        n0 = 1;
529
81.1k
    if (params.C1 == NULL)
530
33
        n1 = 1;
531
81.1k
    if (params.Range == 0)
532
72.1k
        params.n = n0;   /* either one will do */
533
81.1k
    if (n0 != n1 || n0 != params.n) {
534
170
        code = gs_note_error(gs_error_rangecheck);
535
170
        goto function_2_error;
536
170
    }
537
538
80.9k
    code = gs_function_ElIn_init(ppfn, &params, ctx->memory);
539
80.9k
    if (code < 0)
540
340
        goto function_2_error;
541
542
80.6k
    return 0;
543
544
519
function_2_error:
545
519
    gs_function_ElIn_free_params(&params, ctx->memory);
546
519
    mnDR->Range = NULL;
547
519
    mnDR->Domain = NULL;
548
519
    return code;
549
80.9k
}
550
551
static int
552
pdfi_build_function_3(pdf_context *ctx, gs_function_params_t * mnDR,
553
                    pdf_dict *function_dict, const float *shading_domain, int num_inputs, pdf_dict *page_dict, int depth, gs_function_t ** ppfn)
554
17.5k
{
555
17.5k
    gs_function_1ItSg_params_t params;
556
17.5k
    int code, i;
557
17.5k
    pdf_array *Functions = NULL;
558
17.5k
    gs_function_t **ptr = NULL;
559
560
17.5k
    memset(&params, 0x00, sizeof(gs_function_params_t));
561
17.5k
    *(gs_function_params_t *) &params = *mnDR;
562
17.5k
    params.Functions = 0;
563
17.5k
    params.Bounds = 0;
564
17.5k
    params.Encode = 0;
565
566
17.5k
    code = pdfi_dict_get_type(ctx, function_dict, "Functions", PDF_ARRAY, (pdf_obj **)&Functions);
567
17.5k
    if (code < 0)
568
15
        return code;
569
570
17.5k
    params.k = pdfi_array_size(Functions);
571
17.5k
    code = alloc_function_array(params.k, &ptr, ctx->memory);
572
17.5k
    if (code < 0)
573
9
        goto function_3_error;
574
575
17.5k
    params.Functions = (const gs_function_t * const *)ptr;
576
577
17.5k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Bounds, function_dict, "Bounds");
578
17.5k
    if (code < 0)
579
16
        goto function_3_error;
580
581
17.5k
    if (code != params.k - 1) {
582
11
        code = gs_note_error(gs_error_rangecheck);
583
11
        goto function_3_error;
584
11
    }
585
586
17.5k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Encode, function_dict, "Encode");
587
17.5k
    if (code < 0)
588
44
        goto function_3_error;
589
590
17.4k
    if (code != 2 * params.k) {
591
0
        code = gs_note_error(gs_error_rangecheck);
592
0
        goto function_3_error;
593
0
    }
594
17.4k
    code = 0;
595
596
78.9k
    for (i = 0; i < params.k; ++i) {
597
62.6k
        pdf_obj * rsubfn = NULL;
598
599
        /* This is basically hacky. The test file /tests_private/pdf/pdf_1.7_ATS/WWTW61EC_file.pdf
600
         * has a number of shadings on page 2. Although there are numerous shadings, they each use one
601
         * of four functions. However, these functions are themselves type 3 functions with 255
602
         * sub-functions. Because our cache only has 200 entries (at this moment), this overfills
603
         * the cache, ejecting all the cached objects (and then some). Which means that we throw
604
         * out any previous shadings or functions, meaning that on every use we have to reread them. This is,
605
         * obviously, slow. So in the hope that reuse of *sub_functions* is unlikely, we choose to
606
         * read the subfunction without caching. This means the main shadings, and the functions,
607
         * remain cached so we can reuse them saving an enormous amount of time. If we ever find a file
608
         * which significantly reuses sub-functions we may need to revisit this.
609
         */
610
62.6k
        code = pdfi_array_get_nocache(ctx, (pdf_array *)Functions, (int64_t)i, &rsubfn);
611
62.6k
        if (code < 0)
612
1.04k
            goto function_3_error;
613
614
61.5k
        code = pdfi_build_sub_function(ctx, &ptr[i], &params.Encode[i * 2], num_inputs, rsubfn, page_dict);
615
61.5k
        pdfi_countdown(rsubfn);
616
61.5k
        if (code < 0)
617
138
            goto function_3_error;
618
61.5k
    }
619
620
16.3k
    if (params.Range == 0)
621
16.2k
        params.n = params.Functions[0]->params.n;
622
623
16.3k
    code = gs_function_1ItSg_init(ppfn, &params, ctx->memory);
624
16.3k
    if (code < 0)
625
5
        goto function_3_error;
626
627
16.2k
    pdfi_countdown(Functions);
628
16.2k
    return 0;
629
630
1.27k
function_3_error:
631
1.27k
    pdfi_countdown(Functions);
632
1.27k
    gs_function_1ItSg_free_params(&params, ctx->memory);
633
1.27k
    mnDR->Range = NULL;
634
1.27k
    mnDR->Domain = NULL;
635
1.27k
    return code;
636
16.3k
}
637
638
static int pdfi_build_sub_function(pdf_context *ctx, gs_function_t ** ppfn, const float *shading_domain, int num_inputs, pdf_obj *stream_obj, pdf_dict *page_dict)
639
130k
{
640
130k
    int code, i;
641
130k
    int64_t Type;
642
130k
    gs_function_params_t params;
643
130k
    pdf_dict *stream_dict;
644
130k
    int obj_num;
645
646
130k
    params.Range = params.Domain = NULL;
647
648
130k
    code = pdfi_loop_detector_mark(ctx);
649
130k
    if (code < 0)
650
0
        return code;
651
652
130k
    obj_num = pdf_object_num(stream_obj);
653
130k
    if (obj_num != 0) {
654
119k
        if (pdfi_loop_detector_check_object(ctx, obj_num))
655
0
            return gs_note_error(gs_error_circular_reference);
656
119k
        code = pdfi_loop_detector_add_object(ctx, obj_num);
657
119k
        if (code < 0)
658
0
            goto sub_function_error;
659
119k
    }
660
661
130k
    code = pdfi_dict_from_obj(ctx, stream_obj, &stream_dict);
662
130k
    if (code < 0)
663
86
        goto sub_function_error;
664
665
130k
    code = pdfi_dict_get_int(ctx, stream_dict, "FunctionType", &Type);
666
130k
    if (code < 0)
667
1.64k
        goto sub_function_error;
668
669
128k
    if (Type < 0 || Type > 4 || Type == 1) {
670
23
        code = gs_note_error(gs_error_rangecheck);
671
23
        goto sub_function_error;
672
23
    }
673
674
128k
    memset(&params, 0x00, sizeof(gs_function_params_t));
675
676
    /* First gather all the entries common to all functions */
677
128k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Domain, stream_dict, "Domain");
678
128k
    if (code < 0)
679
233
        goto sub_function_error;
680
681
128k
    if (code & 1) {
682
13
        code = gs_error_rangecheck;
683
13
        goto sub_function_error;
684
13
    }
685
686
261k
    for (i=0;i<code;i+=2) {
687
132k
        if (params.Domain[i] > params.Domain[i+1]) {
688
13
            code = gs_error_rangecheck;
689
13
            goto sub_function_error;
690
13
        }
691
132k
    }
692
128k
    if (shading_domain) {
693
90.8k
        if (num_inputs != code >> 1) {
694
11
            code = gs_error_rangecheck;
695
11
            goto sub_function_error;
696
11
        }
697
698
181k
        for (i=0;i<2*num_inputs;i+=2) {
699
90.8k
            if (params.Domain[i] > shading_domain[i] || params.Domain[i+1] < shading_domain[i+1]) {
700
21
                code = gs_error_rangecheck;
701
21
                goto sub_function_error;
702
21
            }
703
90.8k
        }
704
90.8k
    }
705
706
128k
    params.m = code >> 1;
707
708
128k
    code = pdfi_make_float_array_from_dict(ctx, (float **)&params.Range, stream_dict, "Range");
709
128k
    if (code < 0 && code != gs_error_undefined)
710
36
        goto sub_function_error;
711
128k
    else {
712
128k
        if (code > 0)
713
38.6k
            params.n = code >> 1;
714
89.7k
        else
715
89.7k
            params.n = 0;
716
128k
    }
717
128k
    switch(Type) {
718
17.5k
        case 0:
719
17.5k
            code = pdfi_build_function_0(ctx, &params, (pdf_stream *)stream_obj, 0, ppfn);
720
17.5k
            if (code < 0)
721
1.02k
                goto sub_function_error;
722
16.5k
            break;
723
81.1k
        case 2:
724
81.1k
            code = pdfi_build_function_2(ctx, &params, stream_dict, 0, ppfn);
725
81.1k
            if (code < 0)
726
565
                goto sub_function_error;
727
80.6k
            break;
728
80.6k
        case 3:
729
17.5k
            code = pdfi_build_function_3(ctx, &params, stream_dict, shading_domain,  num_inputs, page_dict, 0, ppfn);
730
17.5k
            if (code < 0)
731
1.28k
                goto sub_function_error;
732
16.2k
            break;
733
16.2k
        case 4:
734
12.0k
            code = pdfi_build_function_4(ctx, &params, (pdf_stream *)stream_obj, 0, ppfn);
735
12.0k
            if (code < 0)
736
442
                goto sub_function_error;
737
11.6k
            break;
738
11.6k
        default:
739
0
            break;
740
128k
    }
741
125k
    pdfi_loop_detector_cleartomark(ctx);
742
125k
    return 0;
743
744
5.39k
sub_function_error:
745
5.39k
    gs_free_const_object(ctx->memory, params.Domain, "pdfi_build_sub_function (Domain) error exit\n");
746
5.39k
    gs_free_const_object(ctx->memory, params.Range, "pdfi_build_sub_function(Range) error exit\n");
747
5.39k
    pdfi_loop_detector_cleartomark(ctx);
748
5.39k
    return code;
749
128k
}
750
751
752
static int pdfi_free_function_special(pdf_context *ctx, gs_function_t *pfn);
753
754
#if 0
755
/* For type 0 functions, need to free up the data associated with the stream
756
 * that it was using.  This doesn't get freed in the gs_function_free() code.
757
 */
758
static int pdfi_free_function_0(pdf_context *ctx, gs_function_t *pfn)
759
{
760
    gs_function_Sd_params_t *params = (gs_function_Sd_params_t *)&pfn->params;
761
762
    s_close_filters(&params->DataSource.data.strm, params->DataSource.data.strm->strm);
763
    gs_free_object(ctx->memory, params->DataSource.data.strm, "pdfi_free_function");
764
    return 0;
765
}
766
#endif
767
768
/* For type 3 functions, it has an array of functions that might need special handling.
769
 */
770
static int pdfi_free_function_3(pdf_context *ctx, gs_function_t *pfn)
771
16.2k
{
772
16.2k
    gs_function_1ItSg_params_t *params = (gs_function_1ItSg_params_t *)&pfn->params;
773
16.2k
    int i;
774
775
77.5k
    for (i=0; i<params->k; i++) {
776
61.2k
        pdfi_free_function_special(ctx, (gs_function_t *)params->Functions[i]);
777
61.2k
    }
778
16.2k
    return 0;
779
16.2k
}
780
781
/* Free any special stuff associated with a function */
782
static int pdfi_free_function_special(pdf_context *ctx, gs_function_t *pfn)
783
164k
{
784
164k
    switch(pfn->head.type) {
785
#if 0
786
    /* Before commit 3f2408d5ac786ac1c0a837b600f4ef3be9be0332
787
     * https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3f2408d5ac786ac1c0a837b600f4ef3be9be0332
788
     * we needed to close the data stream and free the memory. That is now
789
     * performed by the graphics library so we don't need to do this any more.
790
     */
791
    case 0:
792
        pdfi_free_function_0(ctx, pfn);
793
        break;
794
#endif
795
16.2k
    case 3:
796
16.2k
        pdfi_free_function_3(ctx, pfn);
797
16.2k
        break;
798
148k
    default:
799
148k
        break;
800
164k
    }
801
164k
    return 0;
802
164k
}
803
804
int pdfi_free_function(pdf_context *ctx, gs_function_t *pfn)
805
111k
{
806
111k
    if (pfn == NULL)
807
7.94k
        return 0;
808
809
    /* Free any special stuff for the function */
810
103k
    pdfi_free_function_special(ctx, pfn);
811
812
    /* Free the standard stuff handled by the gs library */
813
103k
    gs_function_free(pfn, true, ctx->memory);
814
103k
    return 0;
815
111k
}
816
817
int pdfi_build_function(pdf_context *ctx, gs_function_t ** ppfn, const float *shading_domain, int num_inputs, pdf_obj *stream_obj, pdf_dict *page_dict)
818
68.8k
{
819
68.8k
    return pdfi_build_sub_function(ctx, ppfn, shading_domain, num_inputs, stream_obj, page_dict);
820
68.8k
}
821
822
int pdfi_build_halftone_function(pdf_context *ctx, gs_function_t ** ppfn, byte *Buffer, int64_t Length)
823
39.6k
{
824
39.6k
    gs_function_PtCr_params_t params;
825
39.6k
    pdf_c_stream *function_stream = NULL;
826
39.6k
    int code=0;
827
39.6k
    byte *ops = NULL;
828
39.6k
    unsigned int size;
829
39.6k
    float *pfloat;
830
39.6k
    byte *stream_buffer = NULL;
831
832
39.6k
    memset(&params, 0x00, sizeof(gs_function_PtCr_params_t));
833
39.6k
    params.ops.data = 0;  /* in case of failure */
834
39.6k
    params.ops.size = 0;  /* ditto */
835
836
39.6k
    stream_buffer = gs_alloc_bytes(ctx->memory, Length, "pdfi_build_halftone_function(stream_buffer))");
837
39.6k
    if (stream_buffer == NULL)
838
0
        goto halftone_function_error;
839
840
39.6k
    memcpy(stream_buffer, Buffer, Length);
841
842
39.6k
    code = pdfi_open_memory_stream_from_memory(ctx, Length, stream_buffer, &function_stream, true);
843
39.6k
    if (code < 0)
844
0
        goto halftone_function_error;
845
846
39.6k
    size = 0;
847
39.6k
    code = pdfi_parse_type4_func_stream(ctx, function_stream, 0, NULL, &size);
848
39.6k
    if (code < 0)
849
0
        goto halftone_function_error;
850
851
39.6k
    if (size > max_uint - 1) {
852
0
        code = gs_note_error(gs_error_VMerror);
853
0
        goto halftone_function_error;
854
0
    }
855
856
39.6k
    ops = gs_alloc_string(ctx->memory, size + 1, "pdfi_build_halftone_function(ops)");
857
39.6k
    if (ops == NULL) {
858
0
        code = gs_error_VMerror;
859
0
        goto halftone_function_error;
860
0
    }
861
862
39.6k
    code = pdfi_seek(ctx, function_stream, 0, SEEK_SET);
863
39.6k
    if (code < 0)
864
0
        goto halftone_function_error;
865
866
39.6k
    size = 0;
867
39.6k
    code = pdfi_parse_type4_func_stream(ctx, function_stream, 0, ops, &size);
868
39.6k
    if (code < 0)
869
0
        goto halftone_function_error;
870
39.6k
    ops[size] = PtCr_return;
871
872
39.6k
    code = pdfi_close_memory_stream(ctx, stream_buffer, function_stream);
873
39.6k
    if (code < 0) {
874
0
        function_stream = NULL;
875
0
        goto halftone_function_error;
876
0
    }
877
878
39.6k
    params.ops.data = (const byte *)ops;
879
39.6k
    params.ops.size = size + 1;
880
39.6k
    params.m = 2;
881
39.6k
    params.n = 1;
882
39.6k
    pfloat = (float *)gs_alloc_byte_array(ctx->memory, 4, sizeof(float), "pdfi_build_halftone_function(Domain)");
883
39.6k
    if (pfloat == NULL) {
884
0
        code = gs_error_VMerror;
885
0
        goto halftone_function_error;
886
0
    }
887
39.6k
    pfloat[0] = -1;
888
39.6k
    pfloat[1] = 1;
889
39.6k
    pfloat[2] = -1;
890
39.6k
    pfloat[3] = 1;
891
39.6k
    params.Domain = (const float *)pfloat;
892
39.6k
    pfloat = (float *)gs_alloc_byte_array(ctx->memory, 2, sizeof(float), "pdfi_build_halftone_function(Domain)");
893
39.6k
    if (pfloat == NULL) {
894
0
        code = gs_error_VMerror;
895
0
        goto halftone_function_error;
896
0
    }
897
39.6k
    pfloat[0] = -1;
898
39.6k
    pfloat[1] = 1;
899
39.6k
    params.Range = (const float *)pfloat;
900
901
39.6k
    code = gs_function_PtCr_init(ppfn, &params, ctx->memory);
902
39.6k
    if (code < 0)
903
0
        goto halftone_function_error;
904
905
39.6k
    return 0;
906
907
0
halftone_function_error:
908
0
    if (function_stream)
909
0
        (void)pdfi_close_memory_stream(ctx, stream_buffer, function_stream);
910
911
0
    gs_function_PtCr_free_params(&params, ctx->memory);
912
0
    if (ops)
913
0
        gs_free_const_string(ctx->memory, ops, size, "pdfi_build_function_4(ops)");
914
0
    return code;
915
39.6k
}