summaryrefslogtreecommitdiffstats
path: root/source/xap/xpdf/xpdf-3.02pl2.patch
diff options
context:
space:
mode:
author Patrick J Volkerding <volkerdi@slackware.com>2009-08-26 10:00:38 -0500
committer Eric Hameleers <alien@slackware.com>2018-05-31 22:41:17 +0200
commit5a12e7c134274dba706667107d10d231517d3e05 (patch)
tree55718d5acb710fde798d9f38d0bbaf594ed4b296 /source/xap/xpdf/xpdf-3.02pl2.patch
downloadcurrent-5a12e7c134274dba706667107d10d231517d3e05.tar.gz
current-5a12e7c134274dba706667107d10d231517d3e05.tar.xz
Slackware 13.0slackware-13.0
Wed Aug 26 10:00:38 CDT 2009 Slackware 13.0 x86_64 is released as stable! Thanks to everyone who helped make this release possible -- see the RELEASE_NOTES for the credits. The ISOs are off to the replicator. This time it will be a 6 CD-ROM 32-bit set and a dual-sided 32-bit/64-bit x86/x86_64 DVD. We're taking pre-orders now at store.slackware.com. Please consider picking up a copy to help support the project. Once again, thanks to the entire Slackware community for all the help testing and fixing things and offering suggestions during this development cycle. As always, have fun and enjoy! -P.
Diffstat (limited to 'source/xap/xpdf/xpdf-3.02pl2.patch')
-rw-r--r--source/xap/xpdf/xpdf-3.02pl2.patch823
1 files changed, 823 insertions, 0 deletions
diff --git a/source/xap/xpdf/xpdf-3.02pl2.patch b/source/xap/xpdf/xpdf-3.02pl2.patch
new file mode 100644
index 000000000..ab9e3c671
--- /dev/null
+++ b/source/xap/xpdf/xpdf-3.02pl2.patch
@@ -0,0 +1,823 @@
+diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.cc xpdf-3.02/xpdf/Stream.cc
+*** xpdf-3.02pl1.orig/xpdf/Stream.cc Thu Oct 25 15:47:38 2007
+--- xpdf-3.02/xpdf/Stream.cc Thu Oct 25 15:48:19 2007
+***************
+*** 1243,1265 ****
+ columns = columnsA;
+ if (columns < 1) {
+ columns = 1;
+! }
+! if (columns + 4 <= 0) {
+! columns = INT_MAX - 4;
+ }
+ rows = rowsA;
+ endOfBlock = endOfBlockA;
+ black = blackA;
+! refLine = (short *)gmallocn(columns + 3, sizeof(short));
+! codingLine = (short *)gmallocn(columns + 2, sizeof(short));
+
+ eof = gFalse;
+ row = 0;
+ nextLine2D = encoding < 0;
+ inputBits = 0;
+! codingLine[0] = 0;
+! codingLine[1] = refLine[2] = columns;
+! a0 = 1;
+
+ buf = EOF;
+ }
+--- 1243,1268 ----
+ columns = columnsA;
+ if (columns < 1) {
+ columns = 1;
+! } else if (columns > INT_MAX - 2) {
+! columns = INT_MAX - 2;
+ }
+ rows = rowsA;
+ endOfBlock = endOfBlockA;
+ black = blackA;
+! // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
+! // ---> max codingLine size = columns + 1
+! // refLine has one extra guard entry at the end
+! // ---> max refLine size = columns + 2
+! codingLine = (int *)gmallocn(columns + 1, sizeof(int));
+! refLine = (int *)gmallocn(columns + 2, sizeof(int));
+
+ eof = gFalse;
+ row = 0;
+ nextLine2D = encoding < 0;
+ inputBits = 0;
+! codingLine[0] = columns;
+! a0i = 0;
+! outputBits = 0;
+
+ buf = EOF;
+ }
+***************
+*** 1278,1286 ****
+ row = 0;
+ nextLine2D = encoding < 0;
+ inputBits = 0;
+! codingLine[0] = 0;
+! codingLine[1] = columns;
+! a0 = 1;
+ buf = EOF;
+
+ // skip any initial zero bits and end-of-line marker, and get the 2D
+--- 1281,1289 ----
+ row = 0;
+ nextLine2D = encoding < 0;
+ inputBits = 0;
+! codingLine[0] = columns;
+! a0i = 0;
+! outputBits = 0;
+ buf = EOF;
+
+ // skip any initial zero bits and end-of-line marker, and get the 2D
+***************
+*** 1297,1507 ****
+ }
+ }
+
+ int CCITTFaxStream::lookChar() {
+ short code1, code2, code3;
+! int a0New;
+! GBool err, gotEOL;
+! int ret;
+! int bits, i;
+
+! // if at eof just return EOF
+! if (eof && codingLine[a0] >= columns) {
+! return EOF;
+ }
+
+ // read the next row
+! err = gFalse;
+! if (codingLine[a0] >= columns) {
+
+ // 2-D encoding
+ if (nextLine2D) {
+- // state:
+- // a0New = current position in coding line (0 <= a0New <= columns)
+- // codingLine[a0] = last change in coding line
+- // (black-to-white if a0 is even,
+- // white-to-black if a0 is odd)
+- // refLine[b1] = next change in reference line of opposite color
+- // to a0
+- // invariants:
+- // 0 <= codingLine[a0] <= a0New
+- // <= refLine[b1] <= refLine[b1+1] <= columns
+- // 0 <= a0 <= columns+1
+- // refLine[0] = 0
+- // refLine[n] = refLine[n+1] = columns
+- // -- for some 1 <= n <= columns+1
+- // end condition:
+- // 0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
+- // < codingLine[n-1] < codingLine[n] = columns
+- // -- where 1 <= n <= columns+1
+ for (i = 0; codingLine[i] < columns; ++i) {
+ refLine[i] = codingLine[i];
+ }
+! refLine[i] = refLine[i + 1] = columns;
+! b1 = 1;
+! a0New = codingLine[a0 = 0] = 0;
+! do {
+ code1 = getTwoDimCode();
+ switch (code1) {
+ case twoDimPass:
+! if (refLine[b1] < columns) {
+! a0New = refLine[b1 + 1];
+! b1 += 2;
+ }
+ break;
+ case twoDimHoriz:
+! if ((a0 & 1) == 0) {
+! code1 = code2 = 0;
+ do {
+! code1 += code3 = getWhiteCode();
+ } while (code3 >= 64);
+ do {
+! code2 += code3 = getBlackCode();
+ } while (code3 >= 64);
+ } else {
+- code1 = code2 = 0;
+ do {
+! code1 += code3 = getBlackCode();
+ } while (code3 >= 64);
+ do {
+! code2 += code3 = getWhiteCode();
+ } while (code3 >= 64);
+ }
+! if (code1 > 0 || code2 > 0) {
+! if (a0New + code1 <= columns) {
+! codingLine[a0 + 1] = a0New + code1;
+! } else {
+! codingLine[a0 + 1] = columns;
+! }
+! ++a0;
+! if (codingLine[a0] + code2 <= columns) {
+! codingLine[a0 + 1] = codingLine[a0] + code2;
+! } else {
+! codingLine[a0 + 1] = columns;
+! }
+! ++a0;
+! a0New = codingLine[a0];
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+ }
+ break;
+! case twoDimVert0:
+! if (refLine[b1] < columns) {
+! a0New = codingLine[++a0] = refLine[b1];
+! ++b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+- } else {
+- a0New = codingLine[++a0] = columns;
+ }
+ break;
+ case twoDimVertR1:
+! if (refLine[b1] + 1 < columns) {
+! a0New = codingLine[++a0] = refLine[b1] + 1;
+! ++b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+- } else {
+- a0New = codingLine[++a0] = columns;
+ }
+ break;
+! case twoDimVertL1:
+! if (refLine[b1] - 1 > a0New || (a0 == 0 && refLine[b1] == 1)) {
+! a0New = codingLine[++a0] = refLine[b1] - 1;
+! --b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+ }
+ break;
+! case twoDimVertR2:
+! if (refLine[b1] + 2 < columns) {
+! a0New = codingLine[++a0] = refLine[b1] + 2;
+! ++b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+- } else {
+- a0New = codingLine[++a0] = columns;
+ }
+ break;
+ case twoDimVertL2:
+! if (refLine[b1] - 2 > a0New || (a0 == 0 && refLine[b1] == 2)) {
+! a0New = codingLine[++a0] = refLine[b1] - 2;
+! --b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+! }
+! break;
+! case twoDimVertR3:
+! if (refLine[b1] + 3 < columns) {
+! a0New = codingLine[++a0] = refLine[b1] + 3;
+! ++b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+- } else {
+- a0New = codingLine[++a0] = columns;
+ }
+ break;
+! case twoDimVertL3:
+! if (refLine[b1] - 3 > a0New || (a0 == 0 && refLine[b1] == 3)) {
+! a0New = codingLine[++a0] = refLine[b1] - 3;
+! --b1;
+! while (refLine[b1] <= a0New && refLine[b1] < columns) {
+! b1 += 2;
+ }
+ }
+ break;
+ case EOF:
+ eof = gTrue;
+! codingLine[a0 = 0] = columns;
+! return EOF;
+ default:
+ error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
+ err = gTrue;
+ break;
+ }
+! } while (codingLine[a0] < columns);
+
+ // 1-D encoding
+ } else {
+! codingLine[a0 = 0] = 0;
+! while (1) {
+ code1 = 0;
+! do {
+! code1 += code3 = getWhiteCode();
+! } while (code3 >= 64);
+! codingLine[a0+1] = codingLine[a0] + code1;
+! ++a0;
+! if (codingLine[a0] >= columns) {
+! break;
+! }
+! code2 = 0;
+! do {
+! code2 += code3 = getBlackCode();
+! } while (code3 >= 64);
+! codingLine[a0+1] = codingLine[a0] + code2;
+! ++a0;
+! if (codingLine[a0] >= columns) {
+! break;
+ }
+ }
+ }
+
+- if (codingLine[a0] != columns) {
+- error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
+- // force the row to be the correct length
+- while (codingLine[a0] > columns) {
+- --a0;
+- }
+- codingLine[++a0] = columns;
+- err = gTrue;
+- }
+-
+ // byte-align the row
+ if (byteAlign) {
+ inputBits &= ~7;
+--- 1300,1529 ----
+ }
+ }
+
++ inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
++ if (a1 > codingLine[a0i]) {
++ if (a1 > columns) {
++ error(getPos(), "CCITTFax row is wrong length (%d)", a1);
++ err = gTrue;
++ a1 = columns;
++ }
++ if ((a0i & 1) ^ blackPixels) {
++ ++a0i;
++ }
++ codingLine[a0i] = a1;
++ }
++ }
++
++ inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
++ if (a1 > codingLine[a0i]) {
++ if (a1 > columns) {
++ error(getPos(), "CCITTFax row is wrong length (%d)", a1);
++ err = gTrue;
++ a1 = columns;
++ }
++ if ((a0i & 1) ^ blackPixels) {
++ ++a0i;
++ }
++ codingLine[a0i] = a1;
++ } else if (a1 < codingLine[a0i]) {
++ if (a1 < 0) {
++ error(getPos(), "Invalid CCITTFax code");
++ err = gTrue;
++ a1 = 0;
++ }
++ while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
++ --a0i;
++ }
++ codingLine[a0i] = a1;
++ }
++ }
++
+ int CCITTFaxStream::lookChar() {
+ short code1, code2, code3;
+! int b1i, blackPixels, i, bits;
+! GBool gotEOL;
+
+! if (buf != EOF) {
+! return buf;
+ }
+
+ // read the next row
+! if (outputBits == 0) {
+!
+! // if at eof just return EOF
+! if (eof) {
+! return EOF;
+! }
+!
+! err = gFalse;
+
+ // 2-D encoding
+ if (nextLine2D) {
+ for (i = 0; codingLine[i] < columns; ++i) {
+ refLine[i] = codingLine[i];
+ }
+! refLine[i++] = columns;
+! refLine[i] = columns;
+! codingLine[0] = 0;
+! a0i = 0;
+! b1i = 0;
+! blackPixels = 0;
+! // invariant:
+! // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
+! // <= columns
+! // exception at left edge:
+! // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
+! // exception at right edge:
+! // refLine[b1i] = refLine[b1i+1] = columns is possible
+! while (codingLine[a0i] < columns) {
+ code1 = getTwoDimCode();
+ switch (code1) {
+ case twoDimPass:
+! addPixels(refLine[b1i + 1], blackPixels);
+! if (refLine[b1i + 1] < columns) {
+! b1i += 2;
+ }
+ break;
+ case twoDimHoriz:
+! code1 = code2 = 0;
+! if (blackPixels) {
+ do {
+! code1 += code3 = getBlackCode();
+ } while (code3 >= 64);
+ do {
+! code2 += code3 = getWhiteCode();
+ } while (code3 >= 64);
+ } else {
+ do {
+! code1 += code3 = getWhiteCode();
+ } while (code3 >= 64);
+ do {
+! code2 += code3 = getBlackCode();
+ } while (code3 >= 64);
+ }
+! addPixels(codingLine[a0i] + code1, blackPixels);
+! if (codingLine[a0i] < columns) {
+! addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
+! }
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+! }
+! break;
+! case twoDimVertR3:
+! addPixels(refLine[b1i] + 3, blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! ++b1i;
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+! case twoDimVertR2:
+! addPixels(refLine[b1i] + 2, blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! ++b1i;
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+ case twoDimVertR1:
+! addPixels(refLine[b1i] + 1, blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! ++b1i;
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+! case twoDimVert0:
+! addPixels(refLine[b1i], blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! ++b1i;
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+! case twoDimVertL3:
+! addPixelsNeg(refLine[b1i] - 3, blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! if (b1i > 0) {
+! --b1i;
+! } else {
+! ++b1i;
+! }
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+ case twoDimVertL2:
+! addPixelsNeg(refLine[b1i] - 2, blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! if (b1i > 0) {
+! --b1i;
+! } else {
+! ++b1i;
+ }
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+! case twoDimVertL1:
+! addPixelsNeg(refLine[b1i] - 1, blackPixels);
+! blackPixels ^= 1;
+! if (codingLine[a0i] < columns) {
+! if (b1i > 0) {
+! --b1i;
+! } else {
+! ++b1i;
+! }
+! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
+! b1i += 2;
+ }
+ }
+ break;
+ case EOF:
++ addPixels(columns, 0);
+ eof = gTrue;
+! break;
+ default:
+ error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
++ addPixels(columns, 0);
+ err = gTrue;
+ break;
+ }
+! }
+
+ // 1-D encoding
+ } else {
+! codingLine[0] = 0;
+! a0i = 0;
+! blackPixels = 0;
+! while (codingLine[a0i] < columns) {
+ code1 = 0;
+! if (blackPixels) {
+! do {
+! code1 += code3 = getBlackCode();
+! } while (code3 >= 64);
+! } else {
+! do {
+! code1 += code3 = getWhiteCode();
+! } while (code3 >= 64);
+ }
++ addPixels(codingLine[a0i] + code1, blackPixels);
++ blackPixels ^= 1;
+ }
+ }
+
+ // byte-align the row
+ if (byteAlign) {
+ inputBits &= ~7;
+***************
+*** 1560,1573 ****
+ // this if we know the stream contains end-of-line markers because
+ // the "just plow on" technique tends to work better otherwise
+ } else if (err && endOfLine) {
+! do {
+ if (code1 == EOF) {
+ eof = gTrue;
+ return EOF;
+ }
+ eatBits(1);
+! code1 = lookBits(13);
+! } while ((code1 >> 1) != 0x001);
+ eatBits(12);
+ if (encoding > 0) {
+ eatBits(1);
+--- 1582,1598 ----
+ // this if we know the stream contains end-of-line markers because
+ // the "just plow on" technique tends to work better otherwise
+ } else if (err && endOfLine) {
+! while (1) {
+! code1 = lookBits(13);
+ if (code1 == EOF) {
+ eof = gTrue;
+ return EOF;
+ }
++ if ((code1 >> 1) == 0x001) {
++ break;
++ }
+ eatBits(1);
+! }
+ eatBits(12);
+ if (encoding > 0) {
+ eatBits(1);
+***************
+*** 1575,1585 ****
+ }
+ }
+
+! a0 = 0;
+! outputBits = codingLine[1] - codingLine[0];
+! if (outputBits == 0) {
+! a0 = 1;
+! outputBits = codingLine[2] - codingLine[1];
+ }
+
+ ++row;
+--- 1600,1610 ----
+ }
+ }
+
+! // set up for output
+! if (codingLine[0] > 0) {
+! outputBits = codingLine[a0i = 0];
+! } else {
+! outputBits = codingLine[a0i = 1];
+ }
+
+ ++row;
+***************
+*** 1587,1625 ****
+
+ // get a byte
+ if (outputBits >= 8) {
+! ret = ((a0 & 1) == 0) ? 0xff : 0x00;
+! if ((outputBits -= 8) == 0) {
+! ++a0;
+! if (codingLine[a0] < columns) {
+! outputBits = codingLine[a0 + 1] - codingLine[a0];
+! }
+ }
+ } else {
+ bits = 8;
+! ret = 0;
+ do {
+ if (outputBits > bits) {
+! i = bits;
+! bits = 0;
+! if ((a0 & 1) == 0) {
+! ret |= 0xff >> (8 - i);
+ }
+! outputBits -= i;
+ } else {
+! i = outputBits;
+! bits -= outputBits;
+! if ((a0 & 1) == 0) {
+! ret |= (0xff >> (8 - i)) << bits;
+ }
+ outputBits = 0;
+! ++a0;
+! if (codingLine[a0] < columns) {
+! outputBits = codingLine[a0 + 1] - codingLine[a0];
+ }
+ }
+! } while (bits > 0 && codingLine[a0] < columns);
+ }
+- buf = black ? (ret ^ 0xff) : ret;
+ return buf;
+ }
+
+--- 1612,1654 ----
+
+ // get a byte
+ if (outputBits >= 8) {
+! buf = (a0i & 1) ? 0x00 : 0xff;
+! outputBits -= 8;
+! if (outputBits == 0 && codingLine[a0i] < columns) {
+! ++a0i;
+! outputBits = codingLine[a0i] - codingLine[a0i - 1];
+ }
+ } else {
+ bits = 8;
+! buf = 0;
+ do {
+ if (outputBits > bits) {
+! buf <<= bits;
+! if (!(a0i & 1)) {
+! buf |= 0xff >> (8 - bits);
+ }
+! outputBits -= bits;
+! bits = 0;
+ } else {
+! buf <<= outputBits;
+! if (!(a0i & 1)) {
+! buf |= 0xff >> (8 - outputBits);
+ }
++ bits -= outputBits;
+ outputBits = 0;
+! if (codingLine[a0i] < columns) {
+! ++a0i;
+! outputBits = codingLine[a0i] - codingLine[a0i - 1];
+! } else if (bits > 0) {
+! buf <<= bits;
+! bits = 0;
+ }
+ }
+! } while (bits);
+! }
+! if (black) {
+! buf ^= 0xff;
+ }
+ return buf;
+ }
+
+***************
+*** 1661,1666 ****
+--- 1690,1698 ----
+ code = 0; // make gcc happy
+ if (endOfBlock) {
+ code = lookBits(12);
++ if (code == EOF) {
++ return 1;
++ }
+ if ((code >> 5) == 0) {
+ p = &whiteTab1[code];
+ } else {
+***************
+*** 1673,1678 ****
+--- 1705,1713 ----
+ } else {
+ for (n = 1; n <= 9; ++n) {
+ code = lookBits(n);
++ if (code == EOF) {
++ return 1;
++ }
+ if (n < 9) {
+ code <<= 9 - n;
+ }
+***************
+*** 1684,1689 ****
+--- 1719,1727 ----
+ }
+ for (n = 11; n <= 12; ++n) {
+ code = lookBits(n);
++ if (code == EOF) {
++ return 1;
++ }
+ if (n < 12) {
+ code <<= 12 - n;
+ }
+***************
+*** 1709,1717 ****
+ code = 0; // make gcc happy
+ if (endOfBlock) {
+ code = lookBits(13);
+ if ((code >> 7) == 0) {
+ p = &blackTab1[code];
+! } else if ((code >> 9) == 0) {
+ p = &blackTab2[(code >> 1) - 64];
+ } else {
+ p = &blackTab3[code >> 7];
+--- 1747,1758 ----
+ code = 0; // make gcc happy
+ if (endOfBlock) {
+ code = lookBits(13);
++ if (code == EOF) {
++ return 1;
++ }
+ if ((code >> 7) == 0) {
+ p = &blackTab1[code];
+! } else if ((code >> 9) == 0 && (code >> 7) != 0) {
+ p = &blackTab2[(code >> 1) - 64];
+ } else {
+ p = &blackTab3[code >> 7];
+***************
+*** 1723,1728 ****
+--- 1764,1772 ----
+ } else {
+ for (n = 2; n <= 6; ++n) {
+ code = lookBits(n);
++ if (code == EOF) {
++ return 1;
++ }
+ if (n < 6) {
+ code <<= 6 - n;
+ }
+***************
+*** 1734,1739 ****
+--- 1778,1786 ----
+ }
+ for (n = 7; n <= 12; ++n) {
+ code = lookBits(n);
++ if (code == EOF) {
++ return 1;
++ }
+ if (n < 12) {
+ code <<= 12 - n;
+ }
+***************
+*** 1747,1752 ****
+--- 1794,1802 ----
+ }
+ for (n = 10; n <= 13; ++n) {
+ code = lookBits(n);
++ if (code == EOF) {
++ return 1;
++ }
+ if (n < 13) {
+ code <<= 13 - n;
+ }
+***************
+*** 1961,1966 ****
+--- 2011,2022 ----
+ // allocate a buffer for the whole image
+ bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
+ bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
++ if (bufWidth <= 0 || bufHeight <= 0 ||
++ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
++ error(getPos(), "Invalid image size in DCT stream");
++ y = height;
++ return;
++ }
+ for (i = 0; i < numComps; ++i) {
+ frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
+ memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
+***************
+*** 3036,3041 ****
+--- 3092,3102 ----
+ }
+ scanInfo.firstCoeff = str->getChar();
+ scanInfo.lastCoeff = str->getChar();
++ if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
++ scanInfo.firstCoeff > scanInfo.lastCoeff) {
++ error(getPos(), "Bad DCT coefficient numbers in scan info block");
++ return gFalse;
++ }
+ c = str->getChar();
+ scanInfo.ah = (c >> 4) & 0x0f;
+ scanInfo.al = c & 0x0f;
+diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.h xpdf-3.02/xpdf/Stream.h
+*** xpdf-3.02pl1.orig/xpdf/Stream.h Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/Stream.h Thu Oct 25 15:48:15 2007
+***************
+*** 528,540 ****
+ int row; // current row
+ int inputBuf; // input buffer
+ int inputBits; // number of bits in input buffer
+! short *refLine; // reference line changing elements
+! int b1; // index into refLine
+! short *codingLine; // coding line changing elements
+! int a0; // index into codingLine
+ int outputBits; // remaining ouput bits
+ int buf; // character buffer
+
+ short getTwoDimCode();
+ short getWhiteCode();
+ short getBlackCode();
+--- 528,542 ----
+ int row; // current row
+ int inputBuf; // input buffer
+ int inputBits; // number of bits in input buffer
+! int *codingLine; // coding line changing elements
+! int *refLine; // reference line changing elements
+! int a0i; // index into codingLine
+! GBool err; // error on current line
+ int outputBits; // remaining ouput bits
+ int buf; // character buffer
+
++ void addPixels(int a1, int black);
++ void addPixelsNeg(int a1, int black);
+ short getTwoDimCode();
+ short getWhiteCode();
+ short getBlackCode();