Bug 593603: Fix problems with tiling.

Two problems with tiling are fixed here.

Firstly, if the tiling bounds are huge, the 'patch' region (the region
we are writing into), can overflow, causing a SEGV due to the paint code
being very confused by pixmaps that go from just under INT_MAX to just
over INT_MIN. Fix this by checking explicitly for overflow in these
bounds.

If the tiles are stupidly huge, but the scissor is small, we can end up
looping many more times than we need to. We fix mapping the scissor
region back through the inverse transform, and intersecting this
with the pattern area.

Problem found in 4201.pdf.SIGSEGV.622.3560, a test file supplied by
Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google Security
Team using Address Sanitizer. Many thanks!
Bug 693503: Fix SEGV in pdf_function.

The pdf function code only expects a maximum of FZ_MAX_COLORS
component functions in a sampling function; more functions than
this causes a buffer overflow. Add some checks to avoid this.

Problem found in 1219.pdf.SIGSEGV.fc0.246, a test file supplied by
Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google Security
Team using Address Sanitizer. Many thanks!
Use new ADD_WITH_SAT macro in place of expanded code.

With added comment to explain the funky boolean logic.
Bug 693503: Fix infinite recursion in OCGs.

If an OCG refers to itself, we end up recursing forever and
eventually stack overflow. Fix with the pdf_dict_mark stuff.

Problem found in 1551.pdf.SIGSEGV.7fd.615, a test file supplied by
Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google Security
Team using Address Sanitizer. Many thanks!
Bug 693503: Fix leak while writing a broken file.

While investigating samples_mupdf_001/2599.pdf.asan.58.1778, a leak
showed up while cleaning the file, due to not dropping an object in
an error case.

 mutool clean -dif samples_mupdf_001/2599.pdf.asan.58.1778 leak.pdf

Simple Fix. Also extend PDF writing so that it can cope with skipping
errors so we at least get something out at the end.

Problem found in a test file supplied by Mateusz "j00ru" Jurczyk and
Gynvael Coldwind of the Google Security Team using Address Sanitizer.
Many thanks!
Bug 693503: Fix leak/illegal memory write caused by stale pointer

When running a softmask, we remove the softmask from the gstate,
then run the group contents, then put the softmask back.

If the gstate stack is moved in the meantime (due to it being
realloced for extension), we can end up with it being moved.
We therefore must recalculate gstate before writing again.

Problem found in a test file, pdf_001/2599.pdf.asan.58.1778 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Bug 693503: Update freetype to fix SEGV

Problem found in a test file, 4174.pdf.SIGSEGV.50c.3529 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!

Fonts extracted from the file supplied to Werner Lemberg who fixed
the problem in freetype. Again, many thanks.
Bug 693503: Fix memory leak in forms handling

An unused dictionary reference could be left dangling. Simple fix
is to drop the reference after use.

Problem found in a test file, 2785.pdf.asan.6d.1985 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Bug 693503: Fix overlong (seemingly infinite) loop of warnings.

When reading a CMAP with values out of range, we can go into a
very long loop emitting the same pair of warnings.

Spot the error case earlier and this give a nicer report.

Problem found in a test file, 3192.pdf.SIGSEGV.b0.2438 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Improve mutool clean behaviour on broken streams.

When cleaning a file with a corrupt stream in it, historically mupdf
would give up when it encountered such a stream. This is often not
what is desired, as information can be lost.

The changes herein allow us to use our best efforts when reading
a stream, so that broken streams are reproduced in the output
cleaned file.

Problem found in a test file, pdf_001/2599.pdf.asan.58.1778 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Squash 2 warnings about fz_warn without a string literal.
Bug 693503: Fix SEGV during pdf function loading from broken file.

If the Function entry does not point to either a dictionary or an
array, we should give up, otherwise we deference a NULL pointer.

Problem found in a test file, 1013.pdf.SIGSEGV.8a7.18 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Bug 693503: Fix leak of pdf object.

When parsing a (broken) PDF stream, we can forget an existing
parsed object when we parse another one. Check for us having
one and free it if we do.

Problem found in a test file, 3289.pdf.asan.77.2545 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Bug 693503: Fix stack overflows due to infinite recursion.

If a colorspace refers to itself as a base, we can get an infinite
recursion and hence stack overflow. Thanks to zeniko for pointing out
that this occurs in embedded CMAPs and stitching functions. Also
solved here.

To avoid having to keep a long list of the objects we've traversed
through, extend the pdf_dict_mark functions to work on all pdf objects,
and hence rename them as pdf_obj_mark etc. Thanks to zeniko again for
feedback on this way of working.

Problem found in a test file, 3882.pdf.SIGSEGV.99.3204 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Make token enum a type to ease debugging