Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
Date: 2021-08-23
Initial Package Version: 9.54.0
Upstream Status: Applied
Origin: http://git.ghostscript.com/?p=ghostpdl.git;a=blobdiff_plain;f=devices%2Fvector%2Fgdevpdf.c;h=116a9ed82b319fd151ad5a504c3b098967400ae0;hp=f5d095aadacd50c25e650910f7856b02d9900a9b;hb=50dd527e638463fe036fec4b38915151aab9f940;hpb=52bb9ff21d864680c06d4467597fe809edd54a9d
Description: Fixes a segmentation fault, bugs.ghostscript.com/show_bug.cgi?id=703783

diff --git a/devices/vector/gdevpdf.c b/devices/vector/gdevpdf.c
index f5d095aad..116a9ed82 100644
--- a/devices/vector/gdevpdf.c
+++ b/devices/vector/gdevpdf.c
@@ -1089,6 +1089,15 @@ round_box_coord(double xy)
 {
     return (int)(xy * 100 + 0.5) / 100.0;
 }
+static int check_annot_in_named(void *client_data, const byte *key_data, uint key_size, const cos_value_t *value)
+{
+    cos_value_t *v = (cos_value_t *)client_data;
+
+    if (value->contents.object == v->contents.object)
+        return 1;
+    return 0;
+}
+
 static int
 pdf_write_page(gx_device_pdf *pdev, int page_num)
 {
@@ -1411,8 +1420,15 @@ pdf_write_page(gx_device_pdf *pdev, int page_num)
         e = cos_array_element_first(page->Annots);
         while (e != NULL) {
             next = cos_array_element_next(e, &index, &value);
-            if (value->contents.object != NULL)
-                value->contents.object->id = 0;
+            if (value->contents.object != NULL) {
+                /* Check to see if this is a local named object, if it is do not
+                 * zero the ID! This object has not yet been written, because it
+                 * is a named object it can be modified after creation. We must
+                 * allow the named object code to write out the object and free it.
+                 */
+                if (cos_dict_forall(pdev->local_named_objects, value, check_annot_in_named) == 0)
+                    value->contents.object->id = 0;
+            }
             e = next;
         }
         COS_FREE(page->Annots, "pdf_write_page(Annots)");