By default, Bugzilla does not search the list of RESOLVED bugs.
You can force it to do so by putting the upper-case word ALL in front of your search query, e.g.: ALL tdelibs
We recommend searching for bugs this way, as you may discover that your bug has already been resolved and fixed in a later release.

[patch] xpdf-3.02pl4.patch

xpdf-3.02pl4.patch (text/plain), 6.82 KB, created by Darrell on 2012-08-18 10:05:33 CDT

(hide)

Description: xpdf-3.02pl4.patch

Filename:

MIME Type:

Creator: Darrell

Created: 2012-08-18 10:05:33 CDT

Size: 6.82 KB

patch

obsolete

>*** xpdf-3.02.orig/xpdf/Stream.cc Fri Jul 24 14:30:46 2009 >--- xpdf-3.02/xpdf/Stream.cc Mon Oct 5 11:07:49 2009 >*************** >*** 323,328 **** >--- 323,332 ---- > } else { > imgLineSize = nVals; > } >+ if (width > INT_MAX / nComps) { >+ // force a call to gmallocn(-1,...), which will throw an exception >+ imgLineSize = -1; >+ } > imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar)); > imgIdx = nVals; > } >*** xpdf-3.02.orig/xpdf/PSOutputDev.cc Tue Feb 27 14:05:52 2007 >--- xpdf-3.02/xpdf/PSOutputDev.cc Fri Oct 2 12:38:58 2009 >*************** >*** 4301,4307 **** > width, -height, height); > > // allocate a line buffer >! lineBuf = (Guchar *)gmalloc(4 * width); > > // set up to process the data stream > imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(), >--- 4301,4307 ---- > width, -height, height); > > // allocate a line buffer >! lineBuf = (Guchar *)gmallocn(width, 4); > > // set up to process the data stream > imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(), >diff -r -c xpdf-3.02.orig/splash/Splash.cc xpdf-3.02/splash/Splash.cc >*** xpdf-3.02.orig/splash/Splash.cc Tue Feb 27 14:05:52 2007 >--- xpdf-3.02/splash/Splash.cc Fri Aug 14 14:05:08 2009 >*************** >*** 12,17 **** >--- 12,18 ---- > > #include <stdlib.h> > #include <string.h> >+ #include <limits.h> > #include "gmem.h" > #include "SplashErrorCodes.h" > #include "SplashMath.h" >*************** >*** 1912,1918 **** > xq = w % scaledWidth; > > // allocate pixel buffer >! pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w); > > // initialize the pixel pipe > pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha, >--- 1913,1922 ---- > xq = w % scaledWidth; > > // allocate pixel buffer >! if (yp < 0 || yp > INT_MAX - 1) { >! return splashErrBadArg; >! } >! pixBuf = (SplashColorPtr)gmallocn(yp + 1, w); > > // initialize the pixel pipe > pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha, >*************** >*** 2208,2216 **** > xq = w % scaledWidth; > > // allocate pixel buffers >! colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps); > if (srcAlpha) { >! alphaBuf = (Guchar *)gmalloc((yp + 1) * w); > } else { > alphaBuf = NULL; > } >--- 2212,2223 ---- > xq = w % scaledWidth; > > // allocate pixel buffers >! if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) { >! return splashErrBadArg; >! } >! colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps); > if (srcAlpha) { >! alphaBuf = (Guchar *)gmallocn(yp + 1, w); > } else { > alphaBuf = NULL; > } >diff -r -c xpdf-3.02.orig/splash/SplashErrorCodes.h xpdf-3.02/splash/SplashErrorCodes.h >*** xpdf-3.02.orig/splash/SplashErrorCodes.h Tue Feb 27 14:05:52 2007 >--- xpdf-3.02/splash/SplashErrorCodes.h Fri Aug 14 14:03:46 2009 >*************** >*** 29,32 **** >--- 29,34 ---- > > #define splashErrSingularMatrix 8 // matrix is singular > >+ #define splashErrBadArg 9 // bad argument >+ > #endif >*** xpdf-3.02.orig/splash/SplashBitmap.cc Tue Feb 27 14:05:52 2007 >--- xpdf-3.02/splash/SplashBitmap.cc Wed Aug 19 14:55:39 2009 >*************** >*** 11,16 **** >--- 11,17 ---- > #endif > > #include <stdio.h> >+ #include <limits.h> > #include "gmem.h" > #include "SplashErrorCodes.h" > #include "SplashBitmap.h" >*************** >*** 27,56 **** > mode = modeA; > switch (mode) { > case splashModeMono1: >! rowSize = (width + 7) >> 3; > break; > case splashModeMono8: >! rowSize = width; > break; > case splashModeRGB8: > case splashModeBGR8: >! rowSize = width * 3; > break; > #if SPLASH_CMYK > case splashModeCMYK8: >! rowSize = width * 4; > break; > #endif > } >! rowSize += rowPad - 1; >! rowSize -= rowSize % rowPad; >! data = (SplashColorPtr)gmalloc(rowSize * height); > if (!topDown) { > data += (height - 1) * rowSize; > rowSize = -rowSize; > } > if (alphaA) { >! alpha = (Guchar *)gmalloc(width * height); > } else { > alpha = NULL; > } >--- 28,75 ---- > mode = modeA; > switch (mode) { > case splashModeMono1: >! if (width > 0) { >! rowSize = (width + 7) >> 3; >! } else { >! rowSize = -1; >! } > break; > case splashModeMono8: >! if (width > 0) { >! rowSize = width; >! } else { >! rowSize = -1; >! } > break; > case splashModeRGB8: > case splashModeBGR8: >! if (width > 0 && width <= INT_MAX / 3) { >! rowSize = width * 3; >! } else { >! rowSize = -1; >! } > break; > #if SPLASH_CMYK > case splashModeCMYK8: >! if (width > 0 && width <= INT_MAX / 4) { >! rowSize = width * 4; >! } else { >! rowSize = -1; >! } > break; > #endif > } >! if (rowSize > 0) { >! rowSize += rowPad - 1; >! rowSize -= rowSize % rowPad; >! } >! data = (SplashColorPtr)gmallocn(height, rowSize); > if (!topDown) { > data += (height - 1) * rowSize; > rowSize = -rowSize; > } > if (alphaA) { >! alpha = (Guchar *)gmallocn(width, height); > } else { > alpha = NULL; > } >*** xpdf-3.02.orig/xpdf/XRef.cc Tue Feb 27 14:05:52 2007 >--- xpdf-3.02/xpdf/XRef.cc Tue Oct 13 11:57:24 2009 >*************** >*** 52,57 **** >--- 52,59 ---- > // generation 0. > ObjectStream(XRef *xref, int objStrNumA); > >+ GBool isOk() { return ok; } >+ > ~ObjectStream(); > > // Return the object number of this object stream. >*************** >*** 67,72 **** >--- 69,75 ---- > int nObjects; // number of objects in the stream > Object *objs; // the objects (length = nObjects) > int *objNums; // the object numbers (length = nObjects) >+ GBool ok; > }; > > ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { >*************** >*** 80,85 **** >--- 83,89 ---- > nObjects = 0; > objs = NULL; > objNums = NULL; >+ ok = gFalse; > > if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) { > goto err1; >*************** >*** 105,110 **** >--- 109,121 ---- > goto err1; > } > >+ // this is an arbitrary limit to avoid integer overflow problems >+ // in the 'new Object[nObjects]' call (Acrobat apparently limits >+ // object streams to 100-200 objects) >+ if (nObjects > 1000000) { >+ error(-1, "Too many objects in an object stream"); >+ goto err1; >+ } > objs = new Object[nObjects]; > objNums = (int *)gmallocn(nObjects, sizeof(int)); > offsets = (int *)gmallocn(nObjects, sizeof(int)); >*************** >*** 161,170 **** > } > > gfree(offsets); > > err1: > objStr.free(); >- return; > } > > ObjectStream::~ObjectStream() { >--- 172,181 ---- > } > > gfree(offsets); >+ ok = gTrue; > > err1: > objStr.free(); > } > > ObjectStream::~ObjectStream() { >*************** >*** 837,842 **** >--- 848,858 ---- > delete objStr; > } > objStr = new ObjectStream(this, e->offset); >+ if (!objStr->isOk()) { >+ delete objStr; >+ objStr = NULL; >+ goto err; >+ } > } > objStr->getObject(e->gen, num, obj); > break; View Attachment As Diff View Attachment As Raw

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    [x]
  • | Forgot Password
    Login: [x]