diff options
Diffstat (limited to 'print/teTeX-base/files/patch-SA17897')
-rw-r--r-- | print/teTeX-base/files/patch-SA17897 | 120 |
1 files changed, 0 insertions, 120 deletions
diff --git a/print/teTeX-base/files/patch-SA17897 b/print/teTeX-base/files/patch-SA17897 deleted file mode 100644 index 0e523fc5f5e4..000000000000 --- a/print/teTeX-base/files/patch-SA17897 +++ /dev/null @@ -1,120 +0,0 @@ ---- libs/xpdf/xpdf/JPXStream.cc.orig Mon May 17 15:11:49 2004 -+++ libs/xpdf/xpdf/JPXStream.cc Tue Dec 6 18:07:18 2005 -@@ -666,7 +666,7 @@ - int segType; - GBool haveSIZ, haveCOD, haveQCD, haveSOT; - Guint precinctSize, style; -- Guint segLen, capabilities, comp, i, j, r; -+ Guint segLen, capabilities, nTiles, comp, i, j, r; - - //----- main header - haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; -@@ -701,8 +701,13 @@ - / img.xTileSize; - img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) - / img.yTileSize; -- img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles * -- sizeof(JPXTile)); -+ nTiles = img.nXTiles * img.nYTiles; -+ // check for overflow before allocating memory -+ if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) { -+ error(getPos(), "Bad tile count in JPX SIZ marker segment"); -+ return gFalse; -+ } -+ img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile)); - for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { - img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps * - sizeof(JPXTileComp)); ---- libs/xpdf/xpdf/Stream.cc.orig Mon May 17 16:37:57 2004 -+++ libs/xpdf/xpdf/Stream.cc Tue Dec 6 18:05:14 2005 -@@ -407,18 +407,33 @@ - - StreamPredictor::StreamPredictor(Stream *strA, int predictorA, - int widthA, int nCompsA, int nBitsA) { -+ int totalBits; -+ - str = strA; - predictor = predictorA; - width = widthA; - nComps = nCompsA; - nBits = nBitsA; -+ predLine = NULL; -+ ok = gFalse; - - nVals = width * nComps; -+ totalBits = nVals * nBits; -+ if (totalBits == 0 || -+ (totalBits / nBits) / nComps != width || -+ totalBits + 7 < 0) { -+ return; -+ } - pixBytes = (nComps * nBits + 7) >> 3; -- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; -+ rowBytes = ((totalBits + 7) >> 3) + pixBytes; -+ if (rowBytes < 0) { -+ return; -+ } - predLine = (Guchar *)gmalloc(rowBytes); - memset(predLine, 0, rowBytes); - predIdx = rowBytes; -+ -+ ok = gTrue; - } - - StreamPredictor::~StreamPredictor() { -@@ -1012,6 +1027,10 @@ - FilterStream(strA) { - if (predictor != 1) { - pred = new StreamPredictor(this, predictor, columns, colors, bits); -+ if (!pred->isOk()) { -+ delete pred; -+ pred = NULL; -+ } - } else { - pred = NULL; - } -@@ -2897,6 +2916,14 @@ - height = read16(); - width = read16(); - numComps = str->getChar(); -+ if (numComps <= 0 || numComps > 4) { -+ error(getPos(), "Bad number of components in DCT stream", prec); -+ return gFalse; -+ } -+ if (numComps <= 0 || numComps > 4) { -+ error(getPos(), "Bad number of components in DCT stream", prec); -+ return gFalse; -+ } - if (prec != 8) { - error(getPos(), "Bad DCT precision %d", prec); - return gFalse; -@@ -3255,6 +3282,10 @@ - FilterStream(strA) { - if (predictor != 1) { - pred = new StreamPredictor(this, predictor, columns, colors, bits); -+ if (!pred->isOk()) { -+ delete pred; -+ pred = NULL; -+ } - } else { - pred = NULL; - } ---- libs/xpdf/xpdf/Stream.h.orig Mon May 17 16:37:57 2004 -+++ libs/xpdf/xpdf/Stream.h Tue Dec 6 18:05:14 2005 -@@ -233,6 +233,8 @@ - - ~StreamPredictor(); - -+ GBool isOk() { return ok; } -+ - int lookChar(); - int getChar(); - -@@ -250,6 +252,7 @@ - int rowBytes; // bytes per line - Guchar *predLine; // line buffer - int predIdx; // current index in predLine -+ GBool ok; - }; - - //------------------------------------------------------------------------ |