From kde-commits  Wed Dec 22 12:06:35 2004
From: Dirk Mueller <mueller () kde ! org>
Date: Wed, 22 Dec 2004 12:06:35 +0000
To: kde-commits
Subject: koffice/filters/kword/pdf/xpdf/xpdf
Message-Id: <20041222120635.922D01BAD4 () office ! kde ! org>
X-MARC-Message: https://marc.info/?l=kde-commits&m=110371721824539

CVS commit by mueller: 

fix xpdf buffer overflow


  M +3 -1      Gfx.cc   1.4
  M +10 -0     GfxState.cc   1.4


--- koffice/filters/kword/pdf/xpdf/xpdf/Gfx.cc  #1.3:1.4
@@ -2380,5 +2380,7 @@ void Gfx::doImage(Object *ref, Stream *s
     dict->lookup("Mask", &maskObj);
     if (maskObj.isArray()) {
-      for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+      for (i = 0;
+           i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+           ++i) {
         maskObj.arrayGet(i, &obj1);
         maskColors[i] = obj1.getInt();

--- koffice/filters/kword/pdf/xpdf/xpdf/GfxState.cc  #1.3:1.4
@@ -683,4 +683,9 @@ GfxColorSpace *GfxICCBasedColorSpace::pa
   nCompsA = obj2.getInt();
   obj2.free();
+  if (nCompsA > gfxColorMaxComps) {
+    error(-1, "ICCBased color space with too many (%d > %d) components",
+          nCompsA, gfxColorMaxComps);
+    nCompsA = gfxColorMaxComps;
+  }
   if (dict->lookup("Alternate", &obj2)->isNull() ||
       !(altA = GfxColorSpace::parse(&obj2))) {
@@ -1024,4 +1029,9 @@ GfxColorSpace *GfxDeviceNColorSpace::par
   }
   nCompsA = obj1.arrayGetLength();
+  if (nCompsA > gfxColorMaxComps) {
+    error(-1, "DeviceN color space with too many (%d > %d) components",
+·         nCompsA, gfxColorMaxComps);
+    nCompsA = gfxColorMaxComps;
+  }
   for (i = 0; i < nCompsA; ++i) {
     if (!obj1.arrayGet(i, &obj2)->isName()) {