source/xap/xpdf/patches/xpdf-3.02pl1.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

*** xpdf-3.02.orig/xpdf/Stream.cc	Tue Feb 27 14:05:52 2007
--- xpdf-3.02/xpdf/Stream.cc	Thu Jul 26 14:44:43 2007
***************
*** 410,424 ****
    ok = gFalse;
  
    nVals = width * nComps;
-   if (width <= 0 || nComps <= 0 || nBits <= 0 ||
-       nComps >= INT_MAX / nBits ||
-       width >= INT_MAX / nComps / nBits ||
-       nVals * nBits + 7 < 0) {
-     return;
-   }
    pixBytes = (nComps * nBits + 7) >> 3;
    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
!   if (rowBytes <= 0) {
      return;
    }
    predLine = (Guchar *)gmalloc(rowBytes);
--- 410,422 ----
    ok = gFalse;
  
    nVals = width * nComps;
    pixBytes = (nComps * nBits + 7) >> 3;
    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
!   if (width <= 0 || nComps <= 0 || nBits <= 0 ||
!       nComps > gfxColorMaxComps ||
!       nBits > 16 ||
!       width >= INT_MAX / nComps ||      // check for overflow in nVals 
!       nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
      return;
    }
    predLine = (Guchar *)gmalloc(rowBytes);