SOURCES: xpdf-3.02pl1.patch (NEW) - ftp://ftp.foolabs.com/pub/xpdf...

[gotar]

Author: gotar                        Date: Mon Aug 13 23:07:50 2007 GMT
Module: SOURCES                       Tag: HEAD
---- Log message:
- ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl1.patch

---- Files affected:
SOURCES:
   xpdf-3.02pl1.patch (NONE -> 1.1)  (NEW)

---- Diffs:

================================================================
Index: SOURCES/xpdf-3.02pl1.patch
diff -u /dev/null SOURCES/xpdf-3.02pl1.patch:1.1
--- /dev/null	Tue Aug 14 01:07:50 2007
+++ SOURCES/xpdf-3.02pl1.patch	Tue Aug 14 01:07:45 2007
@@ -0,0 +1,33 @@
+*** xpdf-3.02.orig/xpdf/Stream.cc	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/Stream.cc	Thu Jul 26 14:44:43 2007
+***************
+*** 410,424 ****
+    ok = gFalse;
+  
+    nVals = width * nComps;
+-   if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+-       nComps >= INT_MAX / nBits ||
+-       width >= INT_MAX / nComps / nBits ||
+-       nVals * nBits + 7 < 0) {
+-     return;
+-   }
+    pixBytes = (nComps * nBits + 7) >> 3;
+    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+!   if (rowBytes <= 0) {
+      return;
+    }
+    predLine = (Guchar *)gmalloc(rowBytes);
+--- 410,422 ----
+    ok = gFalse;
+  
+    nVals = width * nComps;
+    pixBytes = (nComps * nBits + 7) >> 3;
+    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+!   if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+!       nComps > gfxColorMaxComps ||
+!       nBits > 16 ||
+!       width >= INT_MAX / nComps ||      // check for overflow in nVals 
+!       nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
+      return;
+    }
+    predLine = (Guchar *)gmalloc(rowBytes);
================================================================