swf_{fill,line}_style_array.c の parse count 処理を修正

git-svn-id: svn+ssh://svn.sourceforge.jp/svnroot/swfed/trunk@146 7c90b180-03d5-4157-b861-58a559ae9d1e

diff --git a/src/swf_fill_style_array.c b/src/swf_fill_style_array.c
index 39c81c0..74d6a59 100644 (file)
--- a/src/swf_fill_style_array.c
+++ b/src/swf_fill_style_array.c
@@ -9,8 +9,8 @@ swf_fill_style_array_parse(bitstream_t *bs,
                            swf_tag_t *tag) {
     int i;
     fill_style_array->count = bitstream_getbyte(bs);
-    if (tag->tag != 2 && // ! DefineShape
-        fill_style_array->count == 255) {
+    if ((tag->tag != 2) && // ! DefineShape
+        (fill_style_array->count == 255)) {
         fill_style_array->count = bitstream_getbytesLE(bs, 2);
     }
     fill_style_array->fill_style = calloc(fill_style_array->count, sizeof(swf_fill_style_t));
@@ -25,8 +25,8 @@ swf_fill_style_array_build(bitstream_t *bs,
                            swf_fill_style_array_t *fill_style_array,
                            swf_tag_t *tag) {
     int i;
-    if (tag->tag != 2 && // ! DefineShape
-        255 <= fill_style_array->count) {
+    if ((tag->tag != 2) || // ! DefineShape
+        (255 <= fill_style_array->count)) {
         bitstream_putbyte(bs, 255);
         bitstream_putbytesLE(bs, fill_style_array->count, 2);
     } else {

diff --git a/src/swf_line_style_array.c b/src/swf_line_style_array.c
index 4154683..6de99f2 100644 (file)
--- a/src/swf_line_style_array.c
+++ b/src/swf_line_style_array.c
@@ -9,8 +9,8 @@ swf_line_style_array_parse(bitstream_t *bs,
                            swf_tag_t *tag) {
     int i;
     shape_with_style->count = bitstream_getbyte(bs);
-    if (tag->tag != 2 || // ! DefineShape
-        shape_with_style->count == 255) {
+    if ((tag->tag != 2) && // ! DefineShape
+         (shape_with_style->count == 255)) {
         shape_with_style->count = bitstream_getbytesLE(bs, 2);
     }
     shape_with_style->line_style = calloc(shape_with_style->count, sizeof(swf_line_style_t));
@@ -23,8 +23,8 @@ swf_line_style_array_parse(bitstream_t *bs,
 int
 swf_line_style_array_build(bitstream_t *bs, swf_line_style_array_t *shape_with_style, swf_tag_t *tag) {
     int i;
-    if (tag->tag != 2 || // ! DefineShape
-        255 <= shape_with_style->count) {
+    if ((tag->tag != 2) || // ! DefineShape
+        (255 <= shape_with_style->count)) {
         bitstream_putbyte(bs, 255);
         bitstream_putbytesLE(bs, shape_with_style->count, 2);
     } else {
@@ -40,7 +40,7 @@ int
 swf_line_style_array_print(swf_line_style_array_t *shape_with_style, int indent_depth, swf_tag_t *tag) {
     int i;
     print_indent(indent_depth);
-    printf("count=%u\n", shape_with_style->count);
+    printf("shape_with_style->count=%u\n", shape_with_style->count);
     for (i = 0 ; i < shape_with_style->count ; i++) {
         swf_line_style_print(&(shape_with_style->line_style[i]),
                              indent_depth + 1, tag);

diff --git a/src/swf_shape_record.c b/src/swf_shape_record.c
index 73ca1f6..e3be9ba 100644 (file)
--- a/src/swf_shape_record.c
+++ b/src/swf_shape_record.c
@@ -7,7 +7,8 @@ swf_shape_record_parse(bitstream_t *bs, swf_shape_record_t *shape_record,
                        swf_tag_t *tag, swf_styles_count_t *count) {
     int first_bit, next_5bits;
     swf_shape_record_t *current = shape_record;
-    while (current) {
+    int limit;
+    for (limit = 1; current ; limit ++) {
         shape_record->first_6bits = bitstream_getbits(bs, 6);
         first_bit = (shape_record->first_6bits >> 5) & 1;
         next_5bits = shape_record->first_6bits & 0x1f;
@@ -22,8 +23,14 @@ swf_shape_record_parse(bitstream_t *bs, swf_shape_record_t *shape_record,
         } else {
             swf_shape_record_edge_parse(bs, &(current->shape_edge));
         }
-        current->next = calloc(1, sizeof(*current));
+        if (100 <= limit) {
+            current->next = NULL;
+            fprintf(stderr, "swf_shape_record_parse: limit over\n", limit);
+            return 1;
+        }
+        current->next = calloc(1, sizeof(swf_shape_record_t));
         current = current->next;
+        current->next = NULL; // fail safe
     }
     return 0;
 }
@@ -55,9 +62,12 @@ swf_shape_record_print(swf_shape_record_t *shape_record, int indent_depth,
                        swf_tag_t *tag, swf_styles_count_t *count) {
     int first_bit, next_5bits;
     swf_shape_record_t *current = shape_record;
-    while (current) {
+    int i;
+    for (i = 0 ; current ; i++) {
         first_bit = (shape_record->first_6bits >> 5) & 1;
         next_5bits = shape_record->first_6bits & 0x1f;
+        print_indent(indent_depth);
+        printf("shape_record [%d]\n", i);
         if ((first_bit == 0) && (next_5bits == 0)) {
             swf_shape_record_end_print(&(current->shape_end), indent_depth);
             break;
@@ -83,3 +93,4 @@ swf_shape_record_delete(swf_shape_record_t *shape_record) {
     }
     return 0;
 }
+