[prev in list] [next in list] [prev in thread] [next in thread]
List: kde-commits
Subject: koffice/filters/kword/pdf/xpdf/xpdf
From: Dirk Mueller <mueller () kde ! org>
Date: 2004-12-22 12:06:35
Message-ID: 20041222120635.922D01BAD4 () office ! kde ! org
[Download RAW message or body]
CVS commit by mueller:
fix xpdf buffer overflow
M +3 -1 Gfx.cc 1.4
M +10 -0 GfxState.cc 1.4
--- koffice/filters/kword/pdf/xpdf/xpdf/Gfx.cc #1.3:1.4
@@ -2380,5 +2380,7 @@ void Gfx::doImage(Object *ref, Stream *s
dict->lookup("Mask", &maskObj);
if (maskObj.isArray()) {
- for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+ for (i = 0;
+ i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+ ++i) {
maskObj.arrayGet(i, &obj1);
maskColors[i] = obj1.getInt();
--- koffice/filters/kword/pdf/xpdf/xpdf/GfxState.cc #1.3:1.4
@@ -683,4 +683,9 @@ GfxColorSpace *GfxICCBasedColorSpace::pa
nCompsA = obj2.getInt();
obj2.free();
+ if (nCompsA > gfxColorMaxComps) {
+ error(-1, "ICCBased color space with too many (%d > %d) components",
+ nCompsA, gfxColorMaxComps);
+ nCompsA = gfxColorMaxComps;
+ }
if (dict->lookup("Alternate", &obj2)->isNull() ||
!(altA = GfxColorSpace::parse(&obj2))) {
@@ -1024,4 +1029,9 @@ GfxColorSpace *GfxDeviceNColorSpace::par
}
nCompsA = obj1.arrayGetLength();
+ if (nCompsA > gfxColorMaxComps) {
+ error(-1, "DeviceN color space with too many (%d > %d) components",
+ · nCompsA, gfxColorMaxComps);
+ nCompsA = gfxColorMaxComps;
+ }
for (i = 0; i < nCompsA; ++i) {
if (!obj1.arrayGet(i, &obj2)->isName()) {
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic