*** xpdf-3.02.orig/xpdf/Stream.cc Fri Jul 24 14:30:46 2009
--- xpdf-3.02/xpdf/Stream.cc Mon Oct 5 11:07:49 2009
***************
*** 323,328 ****
--- 323,332 ----
} else {
imgLineSize = nVals;
}
+ if (width > INT_MAX / nComps) {
+ // force a call to gmallocn(-1,...), which will throw an exception
+ imgLineSize = -1;
+ }
imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar));
imgIdx = nVals;
}
*** xpdf-3.02.orig/xpdf/PSOutputDev.cc Tue Feb 27 14:05:52 2007
--- xpdf-3.02/xpdf/PSOutputDev.cc Fri Oct 2 12:38:58 2009
***************
*** 4301,4307 ****
width, -height, height);
// allocate a line buffer
! lineBuf = (Guchar *)gmalloc(4 * width);
// set up to process the data stream
imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
--- 4301,4307 ----
width, -height, height);
// allocate a line buffer
! lineBuf = (Guchar *)gmallocn(width, 4);
// set up to process the data stream
imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
diff -r -c xpdf-3.02.orig/splash/Splash.cc xpdf-3.02/splash/Splash.cc
*** xpdf-3.02.orig/splash/Splash.cc Tue Feb 27 14:05:52 2007
--- xpdf-3.02/splash/Splash.cc Fri Aug 14 14:05:08 2009
***************
*** 12,17 ****
--- 12,18 ----
#include <stdlib.h>
#include <string.h>
+ #include <limits.h>
#include "gmem.h"
#include "SplashErrorCodes.h"
#include "SplashMath.h"
***************
*** 1912,1918 ****
xq = w % scaledWidth;
// allocate pixel buffer
! pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);
// initialize the pixel pipe
pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
--- 1913,1922 ----
xq = w % scaledWidth;
// allocate pixel buffer
! if (yp < 0 || yp > INT_MAX - 1) {
! return splashErrBadArg;
! }
! pixBuf = (SplashColorPtr)gmallocn(yp + 1, w);
// initialize the pixel pipe
pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
***************
*** 2208,2216 ****
xq = w % scaledWidth;
// allocate pixel buffers
! colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);
if (srcAlpha) {
! alphaBuf = (Guchar *)gmalloc((yp + 1) * w);
} else {
alphaBuf = NULL;
}
--- 2212,2223 ----
xq = w % scaledWidth;
// allocate pixel buffers
! if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) {
! return splashErrBadArg;
! }
! colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps);
if (srcAlpha) {
! alphaBuf = (Guchar *)gmallocn(yp + 1, w);
} else {
alphaBuf = NULL;
}
diff -r -c xpdf-3.02.orig/splash/SplashErrorCodes.h xpdf-3.02/splash/SplashErrorCodes.h
*** xpdf-3.02.orig/splash/SplashErrorCodes.h Tue Feb 27 14:05:52 2007
--- xpdf-3.02/splash/SplashErrorCodes.h Fri Aug 14 14:03:46 2009
***************
*** 29,32 ****
--- 29,34 ----
#define splashErrSingularMatrix 8 // matrix is singular
+ #define splashErrBadArg 9 // bad argument
+
#endif
*** xpdf-3.02.orig/splash/SplashBitmap.cc Tue Feb 27 14:05:52 2007
--- xpdf-3.02/splash/SplashBitmap.cc Wed Aug 19 14:55:39 2009
***************
*** 11,16 ****
--- 11,17 ----
#endif
#include <stdio.h>
+ #include <limits.h>
#include "gmem.h"
#include "SplashErrorCodes.h"
#include "SplashBitmap.h"
***************
*** 27,56 ****
mode = modeA;
switch (mode) {
case splashModeMono1:
! rowSize = (width + 7) >> 3;
break;
case splashModeMono8:
! rowSize = width;
break;
case splashModeRGB8:
case splashModeBGR8:
! rowSize = width * 3;
break;
#if SPLASH_CMYK
case splashModeCMYK8:
! rowSize = width * 4;
break;
#endif
}
! rowSize += rowPad - 1;
! rowSize -= rowSize % rowPad;
! data = (SplashColorPtr)gmalloc(rowSize * height);
if (!topDown) {
data += (height - 1) * rowSize;
rowSize = -rowSize;
}
if (alphaA) {
! alpha = (Guchar *)gmalloc(width * height);
} else {
alpha = NULL;
}
--- 28,75 ----
mode = modeA;
switch (mode) {
case splashModeMono1:
! if (width > 0) {
! rowSize = (width + 7) >> 3;
! } else {
! rowSize = -1;
! }
break;
case splashModeMono8:
! if (width > 0) {
! rowSize = width;
! } else {
! rowSize = -1;
! }
break;
case splashModeRGB8:
case splashModeBGR8:
! if (width > 0 && width <= INT_MAX / 3) {
! rowSize = width * 3;
! } else {
! rowSize = -1;
! }
break;
#if SPLASH_CMYK
case splashModeCMYK8:
! if (width > 0 && width <= INT_MAX / 4) {
! rowSize = width * 4;
! } else {
! rowSize = -1;
! }
break;
#endif
}
! if (rowSize > 0) {
! rowSize += rowPad - 1;
! rowSize -= rowSize % rowPad;
! }
! data = (SplashColorPtr)gmallocn(height, rowSize);
if (!topDown) {
data += (height - 1) * rowSize;
rowSize = -rowSize;
}
if (alphaA) {
! alpha = (Guchar *)gmallocn(width, height);
} else {
alpha = NULL;
}
*** xpdf-3.02.orig/xpdf/XRef.cc Tue Feb 27 14:05:52 2007
--- xpdf-3.02/xpdf/XRef.cc Tue Oct 13 11:57:24 2009
***************
*** 52,57 ****
--- 52,59 ----
// generation 0.
ObjectStream(XRef *xref, int objStrNumA);
+ GBool isOk() { return ok; }
+
~ObjectStream();
// Return the object number of this object stream.
***************
*** 67,72 ****
--- 69,75 ----
int nObjects; // number of objects in the stream
Object *objs; // the objects (length = nObjects)
int *objNums; // the object numbers (length = nObjects)
+ GBool ok;
};
ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
***************
*** 80,85 ****
--- 83,89 ----
nObjects = 0;
objs = NULL;
objNums = NULL;
+ ok = gFalse;
if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) {
goto err1;
***************
*** 105,110 ****
--- 109,121 ----
goto err1;
}
+ // this is an arbitrary limit to avoid integer overflow problems
+ // in the 'new Object[nObjects]' call (Acrobat apparently limits
+ // object streams to 100-200 objects)
+ if (nObjects > 1000000) {
+ error(-1, "Too many objects in an object stream");
+ goto err1;
+ }
objs = new Object[nObjects];
objNums = (int *)gmallocn(nObjects, sizeof(int));
offsets = (int *)gmallocn(nObjects, sizeof(int));
***************
*** 161,170 ****
}
gfree(offsets);
err1:
objStr.free();
- return;
}
ObjectStream::~ObjectStream() {
--- 172,181 ----
}
gfree(offsets);
+ ok = gTrue;
err1:
objStr.free();
}
ObjectStream::~ObjectStream() {
***************
*** 837,842 ****
--- 848,858 ----
delete objStr;
}
objStr = new ObjectStream(this, e->offset);
+ if (!objStr->isOk()) {
+ delete objStr;
+ objStr = NULL;
+ goto err;
+ }
}
objStr->getObject(e->gen, num, obj);
break;
