*** xpdf-3.02.orig/xpdf/Stream.cc	Tue Feb 27 14:05:52 2007

--- xpdf-3.02/xpdf/Stream.cc	Thu Jul 26 14:44:43 2007

***************

*** 410,424 ****

    ok = gFalse;

    nVals = width * nComps;

-   if (width <= 0 || nComps <= 0 || nBits <= 0 ||

-       nComps >= INT_MAX / nBits ||

-       width >= INT_MAX / nComps / nBits ||

-       nVals * nBits + 7 < 0) {

-     return;

-   }

    pixBytes = (nComps * nBits + 7) >> 3;

    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;

!   if (rowBytes <= 0) {

      return;

    }

    predLine = (Guchar *)gmalloc(rowBytes);

--- 410,422 ----

    ok = gFalse;

    nVals = width * nComps;

    pixBytes = (nComps * nBits + 7) >> 3;

    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;

!   if (width <= 0 || nComps <= 0 || nBits <= 0 ||

!       nComps > gfxColorMaxComps ||

!       nBits > 16 ||

!       width >= INT_MAX / nComps ||      // check for overflow in nVals 

!       nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes

      return;

    }

    predLine = (Guchar *)gmalloc(rowBytes);