fix BitmapData.copyPixels crashers

1 files changed, 19 insertions, 7 deletions

diff --git a/swfdec/swfdec_bitmap_data.c b/swfdec/swfdec_bitmap_data.c
index 1643f62a..5a7d0f05 100644
--- a/swfdec/swfdec_bitmap_data.c
+++ b/swfdec/swfdec_bitmap_data.c
@@ -356,13 +356,25 @@ swfdec_rectangle_from_as_object (SwfdecRectangle *rect, SwfdecAsObject *object)
 
   /* FIXME: This function is untested */
   val = swfdec_as_object_peek_variable (object, SWFDEC_AS_STR_x);
-  rect->x = swfdec_as_value_to_integer (cx, *val);
+  if (val)
+    rect->x = swfdec_as_value_to_integer (cx, *val);
+  else
+    rect->x = 0;
   val = swfdec_as_object_peek_variable (object, SWFDEC_AS_STR_y);
-  rect->y = swfdec_as_value_to_integer (cx, *val);
+  if (val)
+    rect->y = swfdec_as_value_to_integer (cx, *val);
+  else
+    rect->y = 0;
   val = swfdec_as_object_peek_variable (object, SWFDEC_AS_STR_width);
-  rect->width = swfdec_as_value_to_integer (cx, *val);
+  if (val)
+    rect->width = swfdec_as_value_to_integer (cx, *val);
+  else
+    rect->width = 0;
   val = swfdec_as_object_peek_variable (object, SWFDEC_AS_STR_height);
-  rect->height = swfdec_as_value_to_integer (cx, *val);
+  if (val)
+    rect->height = swfdec_as_value_to_integer (cx, *val);
+  else
+    rect->height = 0;
   return rect->width > 0 && rect->height > 0;
 }
 
@@ -385,7 +397,7 @@ swfdec_bitmap_data_copyPixels (SwfdecAsContext *cx, SwfdecAsObject *object,
     guint argc, SwfdecAsValue *argv, SwfdecAsValue *ret)
 {
   SwfdecBitmapData *bitmap, *source, *alpha = NULL;
-  SwfdecAsObject *recto, *pt, *apt = NULL, *so, *ao = NULL;
+  SwfdecAsObject *recto = NULL, *pt, *apt = NULL, *so, *ao = NULL;
   SwfdecRectangle rect;
   gboolean copy_alpha = FALSE;
   SwfdecColorTransform ctrans;
@@ -393,13 +405,13 @@ swfdec_bitmap_data_copyPixels (SwfdecAsContext *cx, SwfdecAsObject *object,
   cairo_t *cr;
   int x, y;
 
-  SWFDEC_AS_CHECK (SWFDEC_TYPE_BITMAP_DATA, &bitmap, "ooo|OOb", &so, &recto, &pt,
+  SWFDEC_AS_CHECK (SWFDEC_TYPE_BITMAP_DATA, &bitmap, "ooo|oob", &so, &recto, &pt,
       &ao, &apt, &copy_alpha);
 
   if (bitmap->surface == NULL ||
       !SWFDEC_IS_BITMAP_DATA (so->relay) ||
       (source = SWFDEC_BITMAP_DATA (so->relay))->surface == NULL ||
-      (argc > 3 && (!SWFDEC_IS_BITMAP_DATA (ao->relay) || 
+      (ao != NULL && (!SWFDEC_IS_BITMAP_DATA (ao->relay) || 
 		    (alpha = SWFDEC_BITMAP_DATA (ao->relay))->surface == NULL)) ||
       !swfdec_rectangle_from_as_object (&rect, recto))
     return;