Bug 261093 - Crash printing pages containing plugin objects. r=tor, sr=roc, a=asa.

gfx/src/ps/nsEPSObjectPS.cpp

@@ -16,7 +16,7 @@
  * The Original Code is developed for mozilla.
  *
  * The Initial Developer of the Original Code is
- * Kenneth Herron <kherron@newsguy.com>.
+ * Kenneth Herron <kherron@fastmail.us>.
  * Portions created by the Initial Developer are Copyright (C) 2004
  * the Initial Developer. All Rights Reserved.
  *
@@ -52,23 +52,16 @@
  * Constructor
  */
 
-nsEPSObjectPS::nsEPSObjectPS(const char *aData, unsigned long aDataLength) :
+nsEPSObjectPS::nsEPSObjectPS(FILE *aFile) :
   mStatus(NS_ERROR_INVALID_ARG),
-  mData(nsnull),
-  mDataLength(0UL),
-  mCurrPos(nsnull),
+  mEPSF(aFile),
   mBBllx(0.0),
   mBBlly(0.0),
   mBBurx(0.0),
   mBBury(0.0)
 {
-  mData       = aData;
-  mDataLength = aDataLength;
-
-  NS_PRECONDITION(aData != nsnull,   "aData == nsnull");
-  NS_PRECONDITION(aDataLength > 0UL, "No data");    
-
-  Reset();
+  NS_PRECONDITION(aFile != nsnull,   "aFile == nsnull");
+  NS_PRECONDITION(0 == fseek(aFile, 0L, SEEK_SET), "File isn't seekable");    
   Parse();
 }
 
@@ -94,22 +87,22 @@ nsEPSObjectPS::EPSFFgets(nsACString& aBuffer)
 {
   aBuffer.Truncate();
   while (1) {
-    int ch = *mCurrPos++;
+    int ch = getc(mEPSF);
     if ('\n' == ch) {
       /* Eat any following carriage return */
-      ch = *mCurrPos++;
-      if ((mCurrPos < (mData + mDataLength)) && ('\r' != ch))
-        mCurrPos--;
+      ch = getc(mEPSF);
+      if ((EOF != ch) && ('\r' != ch))
+        ungetc(ch, mEPSF);
       return PR_TRUE;
     }
     else if ('\r' == ch) {
       /* Eat any following line feed */
-      ch = *mCurrPos++;
-      if ((mCurrPos < (mData + mDataLength)) && ('\n' != ch))
-        mCurrPos--;
+      ch = getc(mEPSF);
+      if ((EOF != ch) && ('\n' != ch))
+        ungetc(ch, mEPSF);
       return PR_TRUE;
     }
-    else if (mCurrPos >= (mData + mDataLength)) {
+    else if (EOF == ch) {
       /* If we read any text before the EOF, return true. */
       return !aBuffer.IsEmpty();
     }
@@ -119,14 +112,6 @@ nsEPSObjectPS::EPSFFgets(nsACString& aBuffer)
   }
 }
 
-/** ------------------------------------------------------------------
- * Reset current position in data
- */
-void
-nsEPSObjectPS::Reset()
-{
-  mCurrPos = mData;
-}
 
 /** ------------------------------------------------------------------
  * Parse the EPSF and initialize the object accordingly.
@@ -137,7 +122,9 @@ nsEPSObjectPS::Parse()
 {
   nsCAutoString line;
 
-  Reset();   
+  NS_PRECONDITION(nsnull != mEPSF, "No file");
+
+  rewind(mEPSF);
   while (EPSFFgets(line)) {
     if (PR_sscanf(line.get(), "%%%%BoundingBox: %lf %lf %lf %lf",
                   &mBBllx, &mBBlly, &mBBurx, &mBBury) == 4) {
@@ -162,7 +149,7 @@ nsEPSObjectPS::WriteTo(FILE *aDest)
   nsCAutoString line;
   PRBool        inPreview = PR_FALSE;
 
-  Reset();
+  rewind(mEPSF);
   while (EPSFFgets(line)) {
     if (inPreview) {
       /* filter out the print-preview section */

gfx/src/ps/nsEPSObjectPS.h

@@ -16,7 +16,7 @@
  * The Original Code is developed for mozilla.
  *
  * The Initial Developer of the Original Code is
- * Kenneth Herron <kherron@newsguy.com>.
+ * Kenneth Herron <kherron@fastmail.us>.
  * Portions created by the Initial Developer are Copyright (C) 2004
  * the Initial Developer. All Rights Reserved.
  *
@@ -41,19 +41,17 @@
 #define NSEPSOBJECTPS_H
 
 #include <stdio.h>
-#include <stdlib.h>
 
 #include "nscore.h"
 #include "prtypes.h"
 #include "nsString.h"
-#include "nsReadableUtils.h"
 
 class nsEPSObjectPS {
     public:
         /** ---------------------------------------------------
          * Constructor
          */
-        nsEPSObjectPS(const char *aData, unsigned long aDataLength);
+        nsEPSObjectPS(FILE *aFile);
 
         /** ---------------------------------------------------
          * @return the result code from parsing the EPS data.
@@ -80,16 +78,13 @@ class nsEPSObjectPS {
 
     private:
         nsresult        mStatus;
-        const char     *mData;
-        unsigned long   mDataLength;
-        const char     *mCurrPos;
+        FILE *          mEPSF;
         PRFloat64       mBBllx,
                         mBBlly,
                         mBBurx,
                         mBBury;
 
         void            Parse();
-        void            Reset();
         PRBool          EPSFFgets(nsACString& aBuffer);
 };
 

gfx/src/ps/nsRenderingContextPS.cpp

@@ -51,8 +51,6 @@
 #include "nsEPSObjectPS.h"
 #include "nsLocalFile.h"
 
-#include <sys/mman.h>
-#include <errno.h>
 #include <stdio.h>
 #include <math.h>
 
@@ -1380,28 +1378,14 @@ NS_IMETHODIMP nsRenderingContextPS::RetrieveCurrentNativeGraphicData(PRUint32 *
 NS_IMETHODIMP nsRenderingContextPS::RenderEPS(const nsRect& aRect, FILE *aDataFile)
 {
   nsresult    rv;
-  int         fd;
-  const char *data;
-  size_t      datalen;
 
   /* EPSFs aren't supposed to have side effects, so if width or height is
    * zero, just return. */
   if ((aRect.width == 0) || (aRect.height == 0))
     return NS_OK;
 
-  /* Get file size */
-  fseek(aDataFile, 0, SEEK_END);
-  datalen = ftell(aDataFile);
-
-  fflush(aDataFile);
-  fd = fileno(aDataFile);
-  data = (const char *)mmap(0, datalen, PROT_READ, MAP_SHARED, fd, 0); 
-  if ((int)data == -1)
-    return nsresultForErrno(errno);
-
-  nsEPSObjectPS eps(data, datalen);
+  nsEPSObjectPS eps(aDataFile);
   if (NS_FAILED(eps.GetStatus())) {
-    munmap((char *)data, datalen);
     return NS_ERROR_INVALID_ARG;
   }
  
@@ -1410,8 +1394,6 @@ NS_IMETHODIMP nsRenderingContextPS::RenderEPS(const nsRect& aRect, FILE *aDataFi
  
   rv = mPSObj->render_eps(trect, eps);
 
-  munmap((char *)data, datalen);
-  
   return rv;
 }
 

gfx/src/xprint/nsRenderingContextXp.cpp

@@ -226,7 +226,7 @@ nsRenderingContextXp::RenderEPS(const nsRect& aRect, FILE *aDataFile)
   fd = fileno(aDataFile);
   PR_LOG(RenderingContextXpLM, PR_LOG_DEBUG, ("fileno=%d\n", fd));  
   data = (const unsigned char *)mmap(0, datalen, PROT_READ, MAP_SHARED, fd, 0); 
-  if ((int)data == -1) {
+  if (MAP_FAILED == data) {
     int saved_errno = errno;
     PR_LOG(RenderingContextXpLM, PR_LOG_DEBUG, ("mmap() failure, errno=%s/%d\n",
            strerror(saved_errno), saved_errno));