*** xpdf-3.02.orig/xpdf/Stream.cc	Fri Jul 24 14:30:46 2009

--- xpdf-3.02/xpdf/Stream.cc	Mon Oct  5 11:07:49 2009

***************

*** 323,328 ****

--- 323,332 ----

    } else {

      imgLineSize = nVals;

    }

+   if (width > INT_MAX / nComps) {

+     // force a call to gmallocn(-1,...), which will throw an exception

+     imgLineSize = -1;

+   }

    imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar));

    imgIdx = nVals;

  }

*** xpdf-3.02.orig/xpdf/PSOutputDev.cc	Tue Feb 27 14:05:52 2007

--- xpdf-3.02/xpdf/PSOutputDev.cc	Fri Oct  2 12:38:58 2009

***************

*** 4301,4307 ****

  	     width, -height, height);

    // allocate a line buffer

!   lineBuf = (Guchar *)gmalloc(4 * width);

    // set up to process the data stream

    imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),

--- 4301,4307 ----

  	     width, -height, height);

    // allocate a line buffer

!   lineBuf = (Guchar *)gmallocn(width, 4);

    // set up to process the data stream

    imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),

diff -r -c xpdf-3.02.orig/splash/Splash.cc xpdf-3.02/splash/Splash.cc

*** xpdf-3.02.orig/splash/Splash.cc	Tue Feb 27 14:05:52 2007

--- xpdf-3.02/splash/Splash.cc	Fri Aug 14 14:05:08 2009

***************

*** 12,17 ****

--- 12,18 ----

  #include <stdlib.h>

  #include <string.h>

+ #include <limits.h>

  #include "gmem.h"

  #include "SplashErrorCodes.h"

  #include "SplashMath.h"

***************

*** 1912,1918 ****

    xq = w % scaledWidth;

    // allocate pixel buffer

!   pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);

    // initialize the pixel pipe

    pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,

--- 1913,1922 ----

    xq = w % scaledWidth;

    // allocate pixel buffer

!   if (yp < 0 || yp > INT_MAX - 1) {

!     return splashErrBadArg;

!   }

!   pixBuf = (SplashColorPtr)gmallocn(yp + 1, w);

    // initialize the pixel pipe

    pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,

***************

*** 2208,2216 ****

    xq = w % scaledWidth;

    // allocate pixel buffers

!   colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);

    if (srcAlpha) {

!     alphaBuf = (Guchar *)gmalloc((yp + 1) * w);

    } else {

      alphaBuf = NULL;

    }

--- 2212,2223 ----

    xq = w % scaledWidth;

    // allocate pixel buffers

!   if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) {

!     return splashErrBadArg;

!   }

!   colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps);

    if (srcAlpha) {

!     alphaBuf = (Guchar *)gmallocn(yp + 1, w);

    } else {

      alphaBuf = NULL;

    }

diff -r -c xpdf-3.02.orig/splash/SplashErrorCodes.h xpdf-3.02/splash/SplashErrorCodes.h

*** xpdf-3.02.orig/splash/SplashErrorCodes.h	Tue Feb 27 14:05:52 2007

--- xpdf-3.02/splash/SplashErrorCodes.h	Fri Aug 14 14:03:46 2009

***************

*** 29,32 ****

--- 29,34 ----

  #define splashErrSingularMatrix  8	// matrix is singular

+ #define splashErrBadArg          9	// bad argument

+ 

  #endif

*** xpdf-3.02.orig/splash/SplashBitmap.cc	Tue Feb 27 14:05:52 2007

--- xpdf-3.02/splash/SplashBitmap.cc	Wed Aug 19 14:55:39 2009

***************

*** 11,16 ****

--- 11,17 ----

  #endif

  #include <stdio.h>

+ #include <limits.h>

  #include "gmem.h"

  #include "SplashErrorCodes.h"

  #include "SplashBitmap.h"

***************

*** 27,56 ****

    mode = modeA;

    switch (mode) {

    case splashModeMono1:

!     rowSize = (width + 7) >> 3;

      break;

    case splashModeMono8:

!     rowSize = width;

      break;

    case splashModeRGB8:

    case splashModeBGR8:

!     rowSize = width * 3;

      break;

  #if SPLASH_CMYK

    case splashModeCMYK8:

!     rowSize = width * 4;

      break;

  #endif

    }

!   rowSize += rowPad - 1;

!   rowSize -= rowSize % rowPad;

!   data = (SplashColorPtr)gmalloc(rowSize * height);

    if (!topDown) {

      data += (height - 1) * rowSize;

      rowSize = -rowSize;

    }

    if (alphaA) {

!     alpha = (Guchar *)gmalloc(width * height);

    } else {

      alpha = NULL;

    }

--- 28,75 ----

    mode = modeA;

    switch (mode) {

    case splashModeMono1:

!     if (width > 0) {

!       rowSize = (width + 7) >> 3;

!     } else {

!       rowSize = -1;

!     }

      break;

    case splashModeMono8:

!     if (width > 0) {

!       rowSize = width;

!     } else {

!       rowSize = -1;

!     }

      break;

    case splashModeRGB8:

    case splashModeBGR8:

!     if (width > 0 && width <= INT_MAX / 3) {

!       rowSize = width * 3;

!     } else {

!       rowSize = -1;

!     }

      break;

  #if SPLASH_CMYK

    case splashModeCMYK8:

!     if (width > 0 && width <= INT_MAX / 4) {

!       rowSize = width * 4;

!     } else {

!       rowSize = -1;

!     }

      break;

  #endif

    }

!   if (rowSize > 0) {

!     rowSize += rowPad - 1;

!     rowSize -= rowSize % rowPad;

!   }

!   data = (SplashColorPtr)gmallocn(height, rowSize);

    if (!topDown) {

      data += (height - 1) * rowSize;

      rowSize = -rowSize;

    }

    if (alphaA) {

!     alpha = (Guchar *)gmallocn(width, height);

    } else {

      alpha = NULL;

    }

*** xpdf-3.02.orig/xpdf/XRef.cc	Tue Feb 27 14:05:52 2007

--- xpdf-3.02/xpdf/XRef.cc	Tue Oct 13 11:57:24 2009

***************

*** 52,57 ****

--- 52,59 ----

    // generation 0.

    ObjectStream(XRef *xref, int objStrNumA);

+   GBool isOk() { return ok; }

+ 

    ~ObjectStream();

    // Return the object number of this object stream.

***************

*** 67,72 ****

--- 69,75 ----

    int nObjects;			// number of objects in the stream

    Object *objs;			// the objects (length = nObjects)

    int *objNums;			// the object numbers (length = nObjects)

+   GBool ok;

  };

  ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {

***************

*** 80,85 ****

--- 83,89 ----

    nObjects = 0;

    objs = NULL;

    objNums = NULL;

+   ok = gFalse;

    if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) {

      goto err1;

***************

*** 105,110 ****

--- 109,121 ----

      goto err1;

    }

+   // this is an arbitrary limit to avoid integer overflow problems

+   // in the 'new Object[nObjects]' call (Acrobat apparently limits

+   // object streams to 100-200 objects)

+   if (nObjects > 1000000) {

+     error(-1, "Too many objects in an object stream");

+     goto err1;

+   }

    objs = new Object[nObjects];

    objNums = (int *)gmallocn(nObjects, sizeof(int));

    offsets = (int *)gmallocn(nObjects, sizeof(int));

***************

*** 161,170 ****

    }

    gfree(offsets);

   err1:

    objStr.free();

-   return;

  }

  ObjectStream::~ObjectStream() {

--- 172,181 ----

    }

    gfree(offsets);

+   ok = gTrue;

   err1:

    objStr.free();

  }

  ObjectStream::~ObjectStream() {

***************

*** 837,842 ****

--- 848,858 ----

  	delete objStr;

        }

        objStr = new ObjectStream(this, e->offset);

+       if (!objStr->isOk()) {

+ 	delete objStr;

+ 	objStr = NULL;

+ 	goto err;

+       }

      }

      objStr->getObject(e->gen, num, obj);

      break;