diff options
Diffstat (limited to 'editors/calligra/files/patch-xpdf_security_integer_overflow_2.diff')
-rw-r--r-- | editors/calligra/files/patch-xpdf_security_integer_overflow_2.diff | 41 |
1 files changed, 0 insertions, 41 deletions
diff --git a/editors/calligra/files/patch-xpdf_security_integer_overflow_2.diff b/editors/calligra/files/patch-xpdf_security_integer_overflow_2.diff deleted file mode 100644 index 929a3ba2964c..000000000000 --- a/editors/calligra/files/patch-xpdf_security_integer_overflow_2.diff +++ /dev/null @@ -1,41 +0,0 @@ -diff -u -b -p -u -r1.3 -r1.3.2.1 ---- filters/kword/pdf/xpdf/xpdf/Gfx.cc 25 Jan 2003 23:17:44 -0000 1.3 -+++ filters/kword/pdf/xpdf/xpdf/Gfx.cc 22 Dec 2004 12:07:12 -0000 1.3.2.1 -@@ -2379,7 +2379,9 @@ void Gfx::doImage(Object *ref, Stream *s - haveMask = gFalse; - dict->lookup("Mask", &maskObj); - if (maskObj.isArray()) { -- for (i = 0; i < maskObj.arrayGetLength(); ++i) { -+ for (i = 0; -+ i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps; -+ ++i) { - maskObj.arrayGet(i, &obj1); - maskColors[i] = obj1.getInt(); - obj1.free(); -diff -u -b -p -u -r1.3 -r1.3.2.1 ---- filters/kword/pdf/xpdf/xpdf/GfxState.cc 25 Jan 2003 23:17:44 -0000 1.3 -+++ filters/kword/pdf/xpdf/xpdf/GfxState.cc 22 Dec 2004 12:07:12 -0000 1.3.2.1 -@@ -682,6 +682,11 @@ GfxColorSpace *GfxICCBasedColorSpace::pa - } - nCompsA = obj2.getInt(); - obj2.free(); -+ if (nCompsA > gfxColorMaxComps) { -+ error(-1, "ICCBased color space with too many (%d > %d) components", -+ nCompsA, gfxColorMaxComps); -+ nCompsA = gfxColorMaxComps; -+ } - if (dict->lookup("Alternate", &obj2)->isNull() || - !(altA = GfxColorSpace::parse(&obj2))) { - switch (nCompsA) { -@@ -1023,6 +1028,11 @@ GfxColorSpace *GfxDeviceNColorSpace::par - goto err2; - } - nCompsA = obj1.arrayGetLength(); -+ if (nCompsA > gfxColorMaxComps) { -+ error(-1, "DeviceN color space with too many (%d > %d) components", -+ nCompsA, gfxColorMaxComps); -+ nCompsA = gfxColorMaxComps; -+ } - for (i = 0; i < nCompsA; ++i) { - if (!obj1.arrayGet(i, &obj2)->isName()) { - error(-1, "Bad DeviceN color space (names)"); |