summaryrefslogtreecommitdiffstats
path: root/package/xpdf/xpdf-3.02pl1.patch
diff options
context:
space:
mode:
Diffstat (limited to 'package/xpdf/xpdf-3.02pl1.patch')
-rw-r--r--package/xpdf/xpdf-3.02pl1.patch33
1 files changed, 33 insertions, 0 deletions
diff --git a/package/xpdf/xpdf-3.02pl1.patch b/package/xpdf/xpdf-3.02pl1.patch
new file mode 100644
index 000000000..cd42fb962
--- /dev/null
+++ b/package/xpdf/xpdf-3.02pl1.patch
@@ -0,0 +1,33 @@
+*** xpdf-3.02.orig/xpdf/Stream.cc Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/Stream.cc Thu Jul 26 14:44:43 2007
+***************
+*** 410,424 ****
+ ok = gFalse;
+
+ nVals = width * nComps;
+- if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+- nComps >= INT_MAX / nBits ||
+- width >= INT_MAX / nComps / nBits ||
+- nVals * nBits + 7 < 0) {
+- return;
+- }
+ pixBytes = (nComps * nBits + 7) >> 3;
+ rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+! if (rowBytes <= 0) {
+ return;
+ }
+ predLine = (Guchar *)gmalloc(rowBytes);
+--- 410,422 ----
+ ok = gFalse;
+
+ nVals = width * nComps;
+ pixBytes = (nComps * nBits + 7) >> 3;
+ rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+! if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+! nComps > gfxColorMaxComps ||
+! nBits > 16 ||
+! width >= INT_MAX / nComps || // check for overflow in nVals
+! nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
+ return;
+ }
+ predLine = (Guchar *)gmalloc(rowBytes);