1 |
tgurr 07/11/08 23:29:34 |
2 |
|
3 |
Added: poppler-0.6.1-xpdf-3.02pl2.patch |
4 |
digest-poppler-0.6.1-r1 |
5 |
Log: |
6 |
New revision poppler-0.6.1-r1, fixes security bug #196735. |
7 |
(Portage version: 2.1.3.19) |
8 |
|
9 |
Revision Changes Path |
10 |
1.1 app-text/poppler/files/poppler-0.6.1-xpdf-3.02pl2.patch |
11 |
|
12 |
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-text/poppler/files/poppler-0.6.1-xpdf-3.02pl2.patch?rev=1.1&view=markup |
13 |
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-text/poppler/files/poppler-0.6.1-xpdf-3.02pl2.patch?rev=1.1&content-type=text/plain |
14 |
|
15 |
Index: poppler-0.6.1-xpdf-3.02pl2.patch |
16 |
=================================================================== |
17 |
Index: Stream.cc |
18 |
=================================================================== |
19 |
--- poppler/Stream.cc.orig |
20 |
+++ poppler/Stream.cc |
21 |
@@ -1251,23 +1251,26 @@ CCITTFaxStream::CCITTFaxStream(Stream *s |
22 |
columns = columnsA; |
23 |
if (columns < 1) { |
24 |
columns = 1; |
25 |
- } |
26 |
- if (columns + 4 <= 0) { |
27 |
- columns = INT_MAX - 4; |
28 |
+ } else if (columns > INT_MAX - 2) { |
29 |
+ columns = INT_MAX - 2; |
30 |
} |
31 |
rows = rowsA; |
32 |
endOfBlock = endOfBlockA; |
33 |
black = blackA; |
34 |
- refLine = (short *)gmallocn(columns + 3, sizeof(short)); |
35 |
- codingLine = (short *)gmallocn(columns + 2, sizeof(short)); |
36 |
+ // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns |
37 |
+ // ---> max codingLine size = columns + 1 |
38 |
+ // refLine has one extra guard entry at the end |
39 |
+ // ---> max refLine size = columns + 2 |
40 |
+ codingLine = (int *)gmallocn(columns + 1, sizeof(int)); |
41 |
+ refLine = (int *)gmallocn(columns + 2, sizeof(int)); |
42 |
|
43 |
eof = gFalse; |
44 |
row = 0; |
45 |
nextLine2D = encoding < 0; |
46 |
inputBits = 0; |
47 |
- codingLine[0] = 0; |
48 |
- codingLine[1] = refLine[2] = columns; |
49 |
- a0 = 1; |
50 |
+ codingLine[0] = columns; |
51 |
+ a0i = 0; |
52 |
+ outputBits = 0; |
53 |
|
54 |
buf = EOF; |
55 |
} |
56 |
@@ -1286,9 +1289,9 @@ void CCITTFaxStream::reset() { |
57 |
row = 0; |
58 |
nextLine2D = encoding < 0; |
59 |
inputBits = 0; |
60 |
- codingLine[0] = 0; |
61 |
- codingLine[1] = columns; |
62 |
- a0 = 1; |
63 |
+ codingLine[0] = columns; |
64 |
+ a0i = 0; |
65 |
+ outputBits = 0; |
66 |
buf = EOF; |
67 |
|
68 |
// skip any initial zero bits and end-of-line marker, and get the 2D |
69 |
@@ -1305,211 +1308,230 @@ void CCITTFaxStream::reset() { |
70 |
} |
71 |
} |
72 |
|
73 |
+inline void CCITTFaxStream::addPixels(int a1, int blackPixels) { |
74 |
+ if (a1 > codingLine[a0i]) { |
75 |
+ if (a1 > columns) { |
76 |
+ error(getPos(), "CCITTFax row is wrong length (%d)", a1); |
77 |
+ err = gTrue; |
78 |
+ a1 = columns; |
79 |
+ } |
80 |
+ if ((a0i & 1) ^ blackPixels) { |
81 |
+ ++a0i; |
82 |
+ } |
83 |
+ codingLine[a0i] = a1; |
84 |
+ } |
85 |
+} |
86 |
+ |
87 |
+inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) { |
88 |
+ if (a1 > codingLine[a0i]) { |
89 |
+ if (a1 > columns) { |
90 |
+ error(getPos(), "CCITTFax row is wrong length (%d)", a1); |
91 |
+ err = gTrue; |
92 |
+ a1 = columns; |
93 |
+ } |
94 |
+ if ((a0i & 1) ^ blackPixels) { |
95 |
+ ++a0i; |
96 |
+ } |
97 |
+ codingLine[a0i] = a1; |
98 |
+ } else if (a1 < codingLine[a0i]) { |
99 |
+ if (a1 < 0) { |
100 |
+ error(getPos(), "Invalid CCITTFax code"); |
101 |
+ err = gTrue; |
102 |
+ a1 = 0; |
103 |
+ } |
104 |
+ while (a0i > 0 && a1 <= codingLine[a0i - 1]) { |
105 |
+ --a0i; |
106 |
+ } |
107 |
+ codingLine[a0i] = a1; |
108 |
+ } |
109 |
+} |
110 |
+ |
111 |
int CCITTFaxStream::lookChar() { |
112 |
short code1, code2, code3; |
113 |
- int a0New; |
114 |
- GBool err, gotEOL; |
115 |
- int ret; |
116 |
- int bits, i; |
117 |
+ int b1i, blackPixels, i, bits; |
118 |
+ GBool gotEOL; |
119 |
|
120 |
- // if at eof just return EOF |
121 |
- if (eof && codingLine[a0] >= columns) { |
122 |
- return EOF; |
123 |
+ if (buf != EOF) { |
124 |
+ return buf; |
125 |
} |
126 |
|
127 |
// read the next row |
128 |
- err = gFalse; |
129 |
- if (codingLine[a0] >= columns) { |
130 |
+ if (outputBits == 0) { |
131 |
+ |
132 |
+ // if at eof just return EOF |
133 |
+ if (eof) { |
134 |
+ return EOF; |
135 |
+ } |
136 |
+ |
137 |
+ err = gFalse; |
138 |
|
139 |
// 2-D encoding |
140 |
if (nextLine2D) { |
141 |
- // state: |
142 |
- // a0New = current position in coding line (0 <= a0New <= columns) |
143 |
- // codingLine[a0] = last change in coding line |
144 |
- // (black-to-white if a0 is even, |
145 |
- // white-to-black if a0 is odd) |
146 |
- // refLine[b1] = next change in reference line of opposite color |
147 |
- // to a0 |
148 |
- // invariants: |
149 |
- // 0 <= codingLine[a0] <= a0New |
150 |
- // <= refLine[b1] <= refLine[b1+1] <= columns |
151 |
- // 0 <= a0 <= columns+1 |
152 |
- // refLine[0] = 0 |
153 |
- // refLine[n] = refLine[n+1] = columns |
154 |
- // -- for some 1 <= n <= columns+1 |
155 |
- // end condition: |
156 |
- // 0 = codingLine[0] <= codingLine[1] < codingLine[2] < ... |
157 |
- // < codingLine[n-1] < codingLine[n] = columns |
158 |
- // -- where 1 <= n <= columns+1 |
159 |
for (i = 0; codingLine[i] < columns; ++i) { |
160 |
refLine[i] = codingLine[i]; |
161 |
} |
162 |
- refLine[i] = refLine[i + 1] = columns; |
163 |
- b1 = 1; |
164 |
- a0New = codingLine[a0 = 0] = 0; |
165 |
- do { |
166 |
+ refLine[i++] = columns; |
167 |
+ refLine[i] = columns; |
168 |
+ codingLine[0] = 0; |
169 |
+ a0i = 0; |
170 |
+ b1i = 0; |
171 |
+ blackPixels = 0; |
172 |
+ // invariant: |
173 |
+ // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] |
174 |
+ // <= columns |
175 |
+ // exception at left edge: |
176 |
+ // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible |
177 |
+ // exception at right edge: |
178 |
+ // refLine[b1i] = refLine[b1i+1] = columns is possible |
179 |
+ while (codingLine[a0i] < columns) { |
180 |
code1 = getTwoDimCode(); |
181 |
switch (code1) { |
182 |
case twoDimPass: |
183 |
- if (refLine[b1] < columns) { |
184 |
- a0New = refLine[b1 + 1]; |
185 |
- b1 += 2; |
186 |
+ addPixels(refLine[b1i + 1], blackPixels); |
187 |
+ if (refLine[b1i + 1] < columns) { |
188 |
+ b1i += 2; |
189 |
} |
190 |
break; |
191 |
case twoDimHoriz: |
192 |
- if ((a0 & 1) == 0) { |
193 |
- code1 = code2 = 0; |
194 |
+ code1 = code2 = 0; |
195 |
+ if (blackPixels) { |
196 |
do { |
197 |
- code1 += code3 = getWhiteCode(); |
198 |
+ code1 += code3 = getBlackCode(); |
199 |
} while (code3 >= 64); |
200 |
do { |
201 |
- code2 += code3 = getBlackCode(); |
202 |
+ code2 += code3 = getWhiteCode(); |
203 |
} while (code3 >= 64); |
204 |
} else { |
205 |
- code1 = code2 = 0; |
206 |
do { |
207 |
- code1 += code3 = getBlackCode(); |
208 |
+ code1 += code3 = getWhiteCode(); |
209 |
} while (code3 >= 64); |
210 |
do { |
211 |
- code2 += code3 = getWhiteCode(); |
212 |
+ code2 += code3 = getBlackCode(); |
213 |
} while (code3 >= 64); |
214 |
} |
215 |
- if (code1 > 0 || code2 > 0) { |
216 |
- if (a0New + code1 <= columns) { |
217 |
- codingLine[a0 + 1] = a0New + code1; |
218 |
- } else { |
219 |
- codingLine[a0 + 1] = columns; |
220 |
- } |
221 |
- ++a0; |
222 |
- if (codingLine[a0] + code2 <= columns) { |
223 |
- codingLine[a0 + 1] = codingLine[a0] + code2; |
224 |
- } else { |
225 |
- codingLine[a0 + 1] = columns; |
226 |
- } |
227 |
- ++a0; |
228 |
- a0New = codingLine[a0]; |
229 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
230 |
- b1 += 2; |
231 |
+ addPixels(codingLine[a0i] + code1, blackPixels); |
232 |
+ if (codingLine[a0i] < columns) { |
233 |
+ addPixels(codingLine[a0i] + code2, blackPixels ^ 1); |
234 |
+ } |
235 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
236 |
+ b1i += 2; |
237 |
+ } |
238 |
+ break; |
239 |
+ case twoDimVertR3: |
240 |
+ addPixels(refLine[b1i] + 3, blackPixels); |
241 |
+ blackPixels ^= 1; |
242 |
+ if (codingLine[a0i] < columns) { |
243 |
+ ++b1i; |
244 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
245 |
+ b1i += 2; |
246 |
} |
247 |
} |
248 |
break; |
249 |
- case twoDimVert0: |
250 |
- if (refLine[b1] < columns) { |
251 |
- a0New = codingLine[++a0] = refLine[b1]; |
252 |
- ++b1; |
253 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
254 |
- b1 += 2; |
255 |
+ case twoDimVertR2: |
256 |
+ addPixels(refLine[b1i] + 2, blackPixels); |
257 |
+ blackPixels ^= 1; |
258 |
+ if (codingLine[a0i] < columns) { |
259 |
+ ++b1i; |
260 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
261 |
+ b1i += 2; |
262 |
} |
263 |
- } else { |
264 |
- a0New = codingLine[++a0] = columns; |
265 |
} |
266 |
break; |
267 |
case twoDimVertR1: |
268 |
- if (refLine[b1] + 1 < columns) { |
269 |
- a0New = codingLine[++a0] = refLine[b1] + 1; |
270 |
- ++b1; |
271 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
272 |
- b1 += 2; |
273 |
+ addPixels(refLine[b1i] + 1, blackPixels); |
274 |
+ blackPixels ^= 1; |
275 |
+ if (codingLine[a0i] < columns) { |
276 |
+ ++b1i; |
277 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
278 |
+ b1i += 2; |
279 |
} |
280 |
- } else { |
281 |
- a0New = codingLine[++a0] = columns; |
282 |
} |
283 |
break; |
284 |
- case twoDimVertL1: |
285 |
- if (refLine[b1] - 1 > a0New || (a0 == 0 && refLine[b1] == 1)) { |
286 |
- a0New = codingLine[++a0] = refLine[b1] - 1; |
287 |
- --b1; |
288 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
289 |
- b1 += 2; |
290 |
+ case twoDimVert0: |
291 |
+ addPixels(refLine[b1i], blackPixels); |
292 |
+ blackPixels ^= 1; |
293 |
+ if (codingLine[a0i] < columns) { |
294 |
+ ++b1i; |
295 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
296 |
+ b1i += 2; |
297 |
} |
298 |
} |
299 |
break; |
300 |
- case twoDimVertR2: |
301 |
- if (refLine[b1] + 2 < columns) { |
302 |
- a0New = codingLine[++a0] = refLine[b1] + 2; |
303 |
- ++b1; |
304 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
305 |
- b1 += 2; |
306 |
+ case twoDimVertL3: |
307 |
+ addPixelsNeg(refLine[b1i] - 3, blackPixels); |
308 |
+ blackPixels ^= 1; |
309 |
+ if (codingLine[a0i] < columns) { |
310 |
+ if (b1i > 0) { |
311 |
+ --b1i; |
312 |
+ } else { |
313 |
+ ++b1i; |
314 |
+ } |
315 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
316 |
+ b1i += 2; |
317 |
} |
318 |
- } else { |
319 |
- a0New = codingLine[++a0] = columns; |
320 |
} |
321 |
break; |
322 |
case twoDimVertL2: |
323 |
- if (refLine[b1] - 2 > a0New || (a0 == 0 && refLine[b1] == 2)) { |
324 |
- a0New = codingLine[++a0] = refLine[b1] - 2; |
325 |
- --b1; |
326 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
327 |
- b1 += 2; |
328 |
+ addPixelsNeg(refLine[b1i] - 2, blackPixels); |
329 |
+ blackPixels ^= 1; |
330 |
+ if (codingLine[a0i] < columns) { |
331 |
+ if (b1i > 0) { |
332 |
+ --b1i; |
333 |
+ } else { |
334 |
+ ++b1i; |
335 |
} |
336 |
- } |
337 |
- break; |
338 |
- case twoDimVertR3: |
339 |
- if (refLine[b1] + 3 < columns) { |
340 |
- a0New = codingLine[++a0] = refLine[b1] + 3; |
341 |
- ++b1; |
342 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
343 |
- b1 += 2; |
344 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
345 |
+ b1i += 2; |
346 |
} |
347 |
- } else { |
348 |
- a0New = codingLine[++a0] = columns; |
349 |
} |
350 |
break; |
351 |
- case twoDimVertL3: |
352 |
- if (refLine[b1] - 3 > a0New || (a0 == 0 && refLine[b1] == 3)) { |
353 |
- a0New = codingLine[++a0] = refLine[b1] - 3; |
354 |
- --b1; |
355 |
- while (refLine[b1] <= a0New && refLine[b1] < columns) { |
356 |
- b1 += 2; |
357 |
+ case twoDimVertL1: |
358 |
+ addPixelsNeg(refLine[b1i] - 1, blackPixels); |
359 |
+ blackPixels ^= 1; |
360 |
+ if (codingLine[a0i] < columns) { |
361 |
+ if (b1i > 0) { |
362 |
+ --b1i; |
363 |
+ } else { |
364 |
+ ++b1i; |
365 |
+ } |
366 |
+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { |
367 |
+ b1i += 2; |
368 |
} |
369 |
} |
370 |
break; |
371 |
case EOF: |
372 |
+ addPixels(columns, 0); |
373 |
eof = gTrue; |
374 |
- codingLine[a0 = 0] = columns; |
375 |
- return EOF; |
376 |
+ break; |
377 |
default: |
378 |
error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1); |
379 |
+ addPixels(columns, 0); |
380 |
err = gTrue; |
381 |
break; |
382 |
} |
383 |
- } while (codingLine[a0] < columns); |
384 |
+ } |
385 |
|
386 |
// 1-D encoding |
387 |
} else { |
388 |
- codingLine[a0 = 0] = 0; |
389 |
- while (1) { |
390 |
+ codingLine[0] = 0; |
391 |
+ a0i = 0; |
392 |
+ blackPixels = 0; |
393 |
+ while (codingLine[a0i] < columns) { |
394 |
code1 = 0; |
395 |
- do { |
396 |
- code1 += code3 = getWhiteCode(); |
397 |
- } while (code3 >= 64); |
398 |
- codingLine[a0+1] = codingLine[a0] + code1; |
399 |
- ++a0; |
400 |
- if (codingLine[a0] >= columns) { |
401 |
- break; |
402 |
- } |
403 |
- code2 = 0; |
404 |
- do { |
405 |
- code2 += code3 = getBlackCode(); |
406 |
- } while (code3 >= 64); |
407 |
- codingLine[a0+1] = codingLine[a0] + code2; |
408 |
- ++a0; |
409 |
- if (codingLine[a0] >= columns) { |
410 |
- break; |
411 |
+ if (blackPixels) { |
412 |
+ do { |
413 |
+ code1 += code3 = getBlackCode(); |
414 |
+ } while (code3 >= 64); |
415 |
+ } else { |
416 |
+ do { |
417 |
+ code1 += code3 = getWhiteCode(); |
418 |
+ } while (code3 >= 64); |
419 |
} |
420 |
+ addPixels(codingLine[a0i] + code1, blackPixels); |
421 |
+ blackPixels ^= 1; |
422 |
} |
423 |
} |
424 |
|
425 |
- if (codingLine[a0] != columns) { |
426 |
- error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]); |
427 |
- // force the row to be the correct length |
428 |
- while (codingLine[a0] > columns) { |
429 |
- --a0; |
430 |
- } |
431 |
- codingLine[++a0] = columns; |
432 |
- err = gTrue; |
433 |
- } |
434 |
- |
435 |
// byte-align the row |
436 |
if (byteAlign) { |
437 |
inputBits &= ~7; |
438 |
@@ -1568,14 +1590,17 @@ int CCITTFaxStream::lookChar() { |
439 |
// this if we know the stream contains end-of-line markers because |
440 |
// the "just plow on" technique tends to work better otherwise |
441 |
} else if (err && endOfLine) { |
442 |
- do { |
443 |
+ while (1) { |
444 |
+ code1 = lookBits(13); |
445 |
if (code1 == EOF) { |
446 |
eof = gTrue; |
447 |
return EOF; |
448 |
} |
449 |
+ if ((code1 >> 1) == 0x001) { |
450 |
+ break; |
451 |
+ } |
452 |
eatBits(1); |
453 |
- code1 = lookBits(13); |
454 |
- } while ((code1 >> 1) != 0x001); |
455 |
+ } |
456 |
eatBits(12); |
457 |
if (encoding > 0) { |
458 |
eatBits(1); |
459 |
@@ -1583,11 +1608,11 @@ int CCITTFaxStream::lookChar() { |
460 |
} |
461 |
} |
462 |
|
463 |
- a0 = 0; |
464 |
- outputBits = codingLine[1] - codingLine[0]; |
465 |
- if (outputBits == 0) { |
466 |
- a0 = 1; |
467 |
- outputBits = codingLine[2] - codingLine[1]; |
468 |
+ // set up for output |
469 |
+ if (codingLine[0] > 0) { |
470 |
+ outputBits = codingLine[a0i = 0]; |
471 |
+ } else { |
472 |
+ outputBits = codingLine[a0i = 1]; |
473 |
} |
474 |
|
475 |
++row; |
476 |
@@ -1595,39 +1620,43 @@ int CCITTFaxStream::lookChar() { |
477 |
|
478 |
// get a byte |
479 |
if (outputBits >= 8) { |
480 |
- ret = ((a0 & 1) == 0) ? 0xff : 0x00; |
481 |
- if ((outputBits -= 8) == 0) { |
482 |
- ++a0; |
483 |
- if (codingLine[a0] < columns) { |
484 |
- outputBits = codingLine[a0 + 1] - codingLine[a0]; |
485 |
- } |
486 |
+ buf = (a0i & 1) ? 0x00 : 0xff; |
487 |
+ outputBits -= 8; |
488 |
+ if (outputBits == 0 && codingLine[a0i] < columns) { |
489 |
+ ++a0i; |
490 |
+ outputBits = codingLine[a0i] - codingLine[a0i - 1]; |
491 |
} |
492 |
} else { |
493 |
bits = 8; |
494 |
- ret = 0; |
495 |
+ buf = 0; |
496 |
do { |
497 |
if (outputBits > bits) { |
498 |
- i = bits; |
499 |
- bits = 0; |
500 |
- if ((a0 & 1) == 0) { |
501 |
- ret |= 0xff >> (8 - i); |
502 |
+ buf <<= bits; |
503 |
+ if (!(a0i & 1)) { |
504 |
+ buf |= 0xff >> (8 - bits); |
505 |
} |
506 |
- outputBits -= i; |
507 |
+ outputBits -= bits; |
508 |
+ bits = 0; |
509 |
} else { |
510 |
- i = outputBits; |
511 |
- bits -= outputBits; |
512 |
- if ((a0 & 1) == 0) { |
513 |
- ret |= (0xff >> (8 - i)) << bits; |
514 |
+ buf <<= outputBits; |
515 |
+ if (!(a0i & 1)) { |
516 |
+ buf |= 0xff >> (8 - outputBits); |
517 |
} |
518 |
+ bits -= outputBits; |
519 |
outputBits = 0; |
520 |
- ++a0; |
521 |
- if (codingLine[a0] < columns) { |
522 |
- outputBits = codingLine[a0 + 1] - codingLine[a0]; |
523 |
+ if (codingLine[a0i] < columns) { |
524 |
+ ++a0i; |
525 |
+ outputBits = codingLine[a0i] - codingLine[a0i - 1]; |
526 |
+ } else if (bits > 0) { |
527 |
+ buf <<= bits; |
528 |
+ bits = 0; |
529 |
} |
530 |
} |
531 |
- } while (bits > 0 && codingLine[a0] < columns); |
532 |
+ } while (bits); |
533 |
+ } |
534 |
+ if (black) { |
535 |
+ buf ^= 0xff; |
536 |
} |
537 |
- buf = black ? (ret ^ 0xff) : ret; |
538 |
return buf; |
539 |
} |
540 |
|
541 |
@@ -1669,6 +1698,9 @@ short CCITTFaxStream::getWhiteCode() { |
542 |
code = 0; // make gcc happy |
543 |
if (endOfBlock) { |
544 |
code = lookBits(12); |
545 |
+ if (code == EOF) { |
546 |
+ return 1; |
547 |
+ } |
548 |
if ((code >> 5) == 0) { |
549 |
p = &whiteTab1[code]; |
550 |
} else { |
551 |
@@ -1681,6 +1713,9 @@ short CCITTFaxStream::getWhiteCode() { |
552 |
} else { |
553 |
for (n = 1; n <= 9; ++n) { |
554 |
code = lookBits(n); |
555 |
+ if (code == EOF) { |
556 |
+ return 1; |
557 |
+ } |
558 |
if (n < 9) { |
559 |
code <<= 9 - n; |
560 |
} |
561 |
@@ -1692,6 +1727,9 @@ short CCITTFaxStream::getWhiteCode() { |
562 |
} |
563 |
for (n = 11; n <= 12; ++n) { |
564 |
code = lookBits(n); |
565 |
+ if (code == EOF) { |
566 |
+ return 1; |
567 |
+ } |
568 |
if (n < 12) { |
569 |
code <<= 12 - n; |
570 |
} |
571 |
@@ -1717,6 +1755,9 @@ short CCITTFaxStream::getBlackCode() { |
572 |
code = 0; // make gcc happy |
573 |
if (endOfBlock) { |
574 |
code = lookBits(13); |
575 |
+ if (code == EOF) { |
576 |
+ return 1; |
577 |
+ } |
578 |
if ((code >> 7) == 0) { |
579 |
p = &blackTab1[code]; |
580 |
} else if ((code >> 9) == 0 && (code >> 7) != 0) { |
581 |
@@ -1731,6 +1772,9 @@ short CCITTFaxStream::getBlackCode() { |
582 |
} else { |
583 |
for (n = 2; n <= 6; ++n) { |
584 |
code = lookBits(n); |
585 |
+ if (code == EOF) { |
586 |
+ return 1; |
587 |
+ } |
588 |
if (n < 6) { |
589 |
code <<= 6 - n; |
590 |
} |
591 |
@@ -1742,6 +1786,9 @@ short CCITTFaxStream::getBlackCode() { |
592 |
} |
593 |
for (n = 7; n <= 12; ++n) { |
594 |
code = lookBits(n); |
595 |
+ if (code == EOF) { |
596 |
+ return 1; |
597 |
+ } |
598 |
if (n < 12) { |
599 |
code <<= 12 - n; |
600 |
} |
601 |
@@ -1755,6 +1802,9 @@ short CCITTFaxStream::getBlackCode() { |
602 |
} |
603 |
for (n = 10; n <= 13; ++n) { |
604 |
code = lookBits(n); |
605 |
+ if (code == EOF) { |
606 |
+ return 1; |
607 |
+ } |
608 |
if (n < 13) { |
609 |
code <<= 13 - n; |
610 |
} |
611 |
@@ -1971,6 +2021,12 @@ void DCTStream::reset() { |
612 |
// allocate a buffer for the whole image |
613 |
bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; |
614 |
bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight; |
615 |
+ if (bufWidth <= 0 || bufHeight <= 0 || |
616 |
+ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { |
617 |
+ error(getPos(), "Invalid image size in DCT stream"); |
618 |
+ y = height; |
619 |
+ return; |
620 |
+ } |
621 |
for (i = 0; i < numComps; ++i) { |
622 |
frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int)); |
623 |
memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int)); |
624 |
@@ -3041,6 +3097,11 @@ GBool DCTStream::readScanInfo() { |
625 |
} |
626 |
scanInfo.firstCoeff = str->getChar(); |
627 |
scanInfo.lastCoeff = str->getChar(); |
628 |
+ if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 || |
629 |
+ scanInfo.firstCoeff > scanInfo.lastCoeff) { |
630 |
+ error(getPos(), "Bad DCT coefficient numbers in scan info block"); |
631 |
+ return gFalse; |
632 |
+ } |
633 |
c = str->getChar(); |
634 |
scanInfo.ah = (c >> 4) & 0x0f; |
635 |
scanInfo.al = c & 0x0f; |
636 |
Index: Stream.h |
637 |
=================================================================== |
638 |
--- poppler/Stream.h.orig |
639 |
+++ poppler/Stream.h |
640 |
@@ -526,13 +526,15 @@ private: |
641 |
int row; // current row |
642 |
int inputBuf; // input buffer |
643 |
int inputBits; // number of bits in input buffer |
644 |
- short *refLine; // reference line changing elements |
645 |
- int b1; // index into refLine |
646 |
- short *codingLine; // coding line changing elements |
647 |
- int a0; // index into codingLine |
648 |
+ int *codingLine; // coding line changing elements |
649 |
+ int *refLine; // reference line changing elements |
650 |
+ int a0i; // index into codingLine |
651 |
+ GBool err; // error on current line |
652 |
int outputBits; // remaining ouput bits |
653 |
int buf; // character buffer |
654 |
|
655 |
+ void addPixels(int a1, int black); |
656 |
+ void addPixelsNeg(int a1, int black); |
657 |
short getTwoDimCode(); |
658 |
short getWhiteCode(); |
659 |
short getBlackCode(); |
660 |
|
661 |
|
662 |
|
663 |
|
664 |
1.1 app-text/poppler/files/digest-poppler-0.6.1-r1 |
665 |
|
666 |
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-text/poppler/files/digest-poppler-0.6.1-r1?rev=1.1&view=markup |
667 |
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-text/poppler/files/digest-poppler-0.6.1-r1?rev=1.1&content-type=text/plain |
668 |
|
669 |
Index: digest-poppler-0.6.1-r1 |
670 |
=================================================================== |
671 |
MD5 78a5f8ff1a3464eddb127577eea7a191 poppler-0.6.1.tar.gz 1286501 |
672 |
RMD160 19496a6b3a5aeb7eca2f7edc2e957868880a90f4 poppler-0.6.1.tar.gz 1286501 |
673 |
SHA256 d4fb2789bf880ce82b4f90f9e269409d81a804e7877265610494646e463d3ff2 poppler-0.6.1.tar.gz 1286501 |
674 |
|
675 |
|
676 |
|
677 |
-- |
678 |
gentoo-commits@g.o mailing list |