summaryrefslogtreecommitdiff
path: root/xpdf
diff options
context:
space:
mode:
authorPhilipp Lohmann [pl] <Philipp.Lohmann@Sun.COM>2009-11-19 12:36:49 +0100
committerPhilipp Lohmann [pl] <Philipp.Lohmann@Sun.COM>2009-11-19 12:36:49 +0100
commitbf3e97339b940da3894cbf1e286c7186bf9baff6 (patch)
treed29bd20cb0fb4b7a5a2d4af245a6cad34021f8ef /xpdf
parent4308b858072163d2ae8f63843a26b9626c47abf9 (diff)
vcl108: #i106742# update xpdf to 3.02pl4
Diffstat (limited to 'xpdf')
-rw-r--r--xpdf/xpdf-3.02.patch272
1 files changed, 236 insertions, 36 deletions
diff --git a/xpdf/xpdf-3.02.patch b/xpdf/xpdf-3.02.patch
index 82d4ffadb701..341ad73132a2 100644
--- a/xpdf/xpdf-3.02.patch
+++ b/xpdf/xpdf-3.02.patch
@@ -1,16 +1,5 @@
---- misc/xpdf-3.02/goo/GString.cc Tue Feb 27 23:05:51 2007
-+++ misc/build/xpdf-3.02/goo/GString.cc Mon Apr 7 13:16:54 2008
-@@ -528,7 +528,7 @@
- if ((neg = x < 0)) {
- x = -x;
- }
-- x = floor(x * pow(10, prec) + 0.5);
-+ x = floor(x * pow(10.0, prec) + 0.5);
- i = bufSize;
- started = !trim;
- for (j = 0; j < prec && i > 1; ++j) {
--- misc/xpdf-3.02/goo/gmem.cc 2007-02-27 23:05:51.000000000 +0100
-+++ misc/build/xpdf-3.02/goo/gmem.cc 2009-04-22 19:21:14.274507454 +0200
++++ misc/build/xpdf-3.02/goo/gmem.cc 2009-11-10 11:43:10.374175496 +0100
@@ -55,7 +55,15 @@
void *data;
unsigned long *trl, *p;
@@ -79,8 +68,19 @@
if (p) {
free(p);
}
---- misc/xpdf-3.02/ms_make.bat Tue Feb 27 23:05:51 2007
-+++ misc/build/xpdf-3.02/ms_make.bat Mon Apr 7 13:16:54 2008
+--- misc/xpdf-3.02/goo/GString.cc 2007-02-27 23:05:51.000000000 +0100
++++ misc/build/xpdf-3.02/goo/GString.cc 2009-11-10 11:43:10.368006116 +0100
+@@ -528,7 +528,7 @@
+ if ((neg = x < 0)) {
+ x = -x;
+ }
+- x = floor(x * pow(10, prec) + 0.5);
++ x = floor(x * pow(10.0, prec) + 0.5);
+ i = bufSize;
+ started = !trim;
+ for (j = 0; j < prec && i > 1; ++j) {
+--- misc/xpdf-3.02/ms_make.bat 2007-02-27 23:05:51.000000000 +0100
++++ misc/build/xpdf-3.02/ms_make.bat 2009-11-10 11:43:10.450112062 +0100
@@ -1,5 +1,5 @@
set CC=cl
-set CFLAGS=/DWIN32 /I.. /I..\goo /I..\fofi /O2 /nologo
@@ -135,8 +135,121 @@
-%CXX% %LINKFLAGS% /Fepdftoppm.exe Annot.obj Array.obj BuiltinFont.obj BuiltinFontTables.obj Catalog.obj CharCodeToUnicode.obj CMap.obj Decrypt.obj Dict.obj Error.obj FontEncodingTables.obj Function.obj Gfx.obj GfxFont.obj GfxState.obj GlobalParams.obj JArithmeticDecoder.obj JBIG2Stream.obj JPXStream.obj Lexer.obj Link.obj NameToCharCode.obj Object.obj Outline.obj OutputDev.obj Page.obj Parser.obj PDFDoc.obj PDFDocEncoding.obj PSTokenizer.obj SecurityHandler.obj SplashOutputDev.obj Stream.obj UnicodeMap.obj UnicodeTypeTable.obj XRef.obj pdftoppm.obj ..\splash\splash.lib ..\fofi\fofi.lib ..\goo\Goo.lib %FT2DIR%\freetype2.lib shell32.lib user32.lib gdi32.lib advapi32.lib
-
-cd ..
+--- misc/xpdf-3.02/splash/SplashBitmap.cc 2007-02-27 23:05:52.000000000 +0100
++++ misc/build/xpdf-3.02/splash/SplashBitmap.cc 2009-11-10 11:43:54.912615507 +0100
+@@ -11,6 +11,7 @@
+ #endif
+
+ #include <stdio.h>
++#include <limits.h>
+ #include "gmem.h"
+ #include "SplashErrorCodes.h"
+ #include "SplashBitmap.h"
+@@ -27,30 +28,48 @@
+ mode = modeA;
+ switch (mode) {
+ case splashModeMono1:
+- rowSize = (width + 7) >> 3;
++ if (width > 0) {
++ rowSize = (width + 7) >> 3;
++ } else {
++ rowSize = -1;
++ }
+ break;
+ case splashModeMono8:
+- rowSize = width;
++ if (width > 0) {
++ rowSize = width;
++ } else {
++ rowSize = -1;
++ }
+ break;
+ case splashModeRGB8:
+ case splashModeBGR8:
+- rowSize = width * 3;
++ if (width > 0 && width <= INT_MAX / 3) {
++ rowSize = width * 3;
++ } else {
++ rowSize = -1;
++ }
+ break;
+ #if SPLASH_CMYK
+ case splashModeCMYK8:
+- rowSize = width * 4;
++ if (width > 0 && width <= INT_MAX / 4) {
++ rowSize = width * 4;
++ } else {
++ rowSize = -1;
++ }
+ break;
+ #endif
+ }
+- rowSize += rowPad - 1;
+- rowSize -= rowSize % rowPad;
+- data = (SplashColorPtr)gmalloc(rowSize * height);
++ if (rowSize > 0) {
++ rowSize += rowPad - 1;
++ rowSize -= rowSize % rowPad;
++ }
++ data = (SplashColorPtr)gmallocn(height, rowSize);
+ if (!topDown) {
+ data += (height - 1) * rowSize;
+ rowSize = -rowSize;
+ }
+ if (alphaA) {
+- alpha = (Guchar *)gmalloc(width * height);
++ alpha = (Guchar *)gmallocn(width, height);
+ } else {
+ alpha = NULL;
+ }
+--- misc/xpdf-3.02/splash/Splash.cc 2007-02-27 23:05:52.000000000 +0100
++++ misc/build/xpdf-3.02/splash/Splash.cc 2009-11-10 11:43:54.894089400 +0100
+@@ -12,6 +12,7 @@
+
+ #include <stdlib.h>
+ #include <string.h>
++#include <limits.h>
+ #include "gmem.h"
+ #include "SplashErrorCodes.h"
+ #include "SplashMath.h"
+@@ -1912,7 +1913,10 @@
+ xq = w % scaledWidth;
+
+ // allocate pixel buffer
+- pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);
++ if (yp < 0 || yp > INT_MAX - 1) {
++ return splashErrBadArg;
++ }
++ pixBuf = (SplashColorPtr)gmallocn(yp + 1, w);
+
+ // initialize the pixel pipe
+ pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
+@@ -2208,9 +2212,12 @@
+ xq = w % scaledWidth;
+
+ // allocate pixel buffers
+- colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);
++ if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) {
++ return splashErrBadArg;
++ }
++ colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps);
+ if (srcAlpha) {
+- alphaBuf = (Guchar *)gmalloc((yp + 1) * w);
++ alphaBuf = (Guchar *)gmallocn(yp + 1, w);
+ } else {
+ alphaBuf = NULL;
+ }
+--- misc/xpdf-3.02/splash/SplashErrorCodes.h 2007-02-27 23:05:52.000000000 +0100
++++ misc/build/xpdf-3.02/splash/SplashErrorCodes.h 2009-11-10 11:43:54.903536237 +0100
+@@ -29,4 +29,6 @@
+
+ #define splashErrSingularMatrix 8 // matrix is singular
+
++#define splashErrBadArg 9 // bad argument
++
+ #endif
--- misc/xpdf-3.02/xpdf/JBIG2Stream.cc 2007-02-27 23:05:52.000000000 +0100
-+++ misc/build/xpdf-3.02/xpdf/JBIG2Stream.cc 2009-04-22 19:21:14.286412894 +0200
++++ misc/build/xpdf-3.02/xpdf/JBIG2Stream.cc 2009-11-10 11:43:10.393213949 +0100
@@ -422,12 +422,14 @@
table[i] = table[len];
@@ -953,7 +1066,7 @@
for (x = 0; x < w; ++x) {
--- misc/xpdf-3.02/xpdf/JBIG2Stream.h 2007-02-27 23:05:52.000000000 +0100
-+++ misc/build/xpdf-3.02/xpdf/JBIG2Stream.h 2009-04-22 19:21:14.293918758 +0200
++++ misc/build/xpdf-3.02/xpdf/JBIG2Stream.h 2009-11-10 11:43:10.400610529 +0100
@@ -78,6 +78,10 @@
Guint *refSegs, Guint nRefSegs);
void readGenericRegionSeg(Guint segNum, GBool imm,
@@ -966,7 +1079,7 @@
int templ, GBool tpgdOn,
GBool useSkip, JBIG2Bitmap *skip,
--- misc/xpdf-3.02/xpdf/Makefile.in 2007-02-27 23:05:52.000000000 +0100
-+++ misc/build/xpdf-3.02/xpdf/Makefile.in 2009-04-22 19:20:56.651099700 +0200
++++ misc/build/xpdf-3.02/xpdf/Makefile.in 2009-11-10 11:43:10.407182402 +0100
@@ -20,6 +20,8 @@
SPLASHLIBDIR = ../splash
@@ -1006,9 +1119,31 @@
#------------------------------------------------------------------------
+--- misc/xpdf-3.02/xpdf/PSOutputDev.cc 2007-02-27 23:05:52.000000000 +0100
++++ misc/build/xpdf-3.02/xpdf/PSOutputDev.cc 2009-11-10 11:43:54.879574544 +0100
+@@ -4301,7 +4301,7 @@
+ width, -height, height);
+
+ // allocate a line buffer
+- lineBuf = (Guchar *)gmalloc(4 * width);
++ lineBuf = (Guchar *)gmallocn(width, 4);
+
+ // set up to process the data stream
+ imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
--- misc/xpdf-3.02/xpdf/Stream.cc 2007-02-27 23:05:52.000000000 +0100
-+++ misc/build/xpdf-3.02/xpdf/Stream.cc 2009-04-22 19:20:56.661311973 +0200
-@@ -410,15 +410,13 @@
++++ misc/build/xpdf-3.02/xpdf/Stream.cc 2009-11-10 11:43:54.863071127 +0100
+@@ -323,6 +323,10 @@
+ } else {
+ imgLineSize = nVals;
+ }
++ if (width > INT_MAX / nComps) {
++ // force a call to gmallocn(-1,...), which will throw an exception
++ imgLineSize = -1;
++ }
+ imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar));
+ imgIdx = nVals;
+ }
+@@ -410,15 +414,13 @@
ok = gFalse;
nVals = width * nComps;
@@ -1029,7 +1164,7 @@
return;
}
predLine = (Guchar *)gmalloc(rowBytes);
-@@ -1245,23 +1243,26 @@
+@@ -1245,23 +1247,26 @@
columns = columnsA;
if (columns < 1) {
columns = 1;
@@ -1064,7 +1199,7 @@
buf = EOF;
}
-@@ -1280,9 +1281,9 @@
+@@ -1280,9 +1285,9 @@
row = 0;
nextLine2D = encoding < 0;
inputBits = 0;
@@ -1077,7 +1212,7 @@
buf = EOF;
// skip any initial zero bits and end-of-line marker, and get the 2D
-@@ -1299,211 +1300,230 @@
+@@ -1299,211 +1304,230 @@
}
}
@@ -1446,7 +1581,7 @@
// byte-align the row
if (byteAlign) {
inputBits &= ~7;
-@@ -1562,14 +1582,17 @@
+@@ -1562,14 +1586,17 @@
// this if we know the stream contains end-of-line markers because
// the "just plow on" technique tends to work better otherwise
} else if (err && endOfLine) {
@@ -1467,7 +1602,7 @@
eatBits(12);
if (encoding > 0) {
eatBits(1);
-@@ -1577,11 +1600,11 @@
+@@ -1577,11 +1604,11 @@
}
}
@@ -1484,7 +1619,7 @@
}
++row;
-@@ -1589,39 +1612,43 @@
+@@ -1589,39 +1616,43 @@
// get a byte
if (outputBits >= 8) {
@@ -1549,7 +1684,7 @@
return buf;
}
-@@ -1663,6 +1690,9 @@
+@@ -1663,6 +1694,9 @@
code = 0; // make gcc happy
if (endOfBlock) {
code = lookBits(12);
@@ -1559,7 +1694,7 @@
if ((code >> 5) == 0) {
p = &whiteTab1[code];
} else {
-@@ -1675,6 +1705,9 @@
+@@ -1675,6 +1709,9 @@
} else {
for (n = 1; n <= 9; ++n) {
code = lookBits(n);
@@ -1569,7 +1704,7 @@
if (n < 9) {
code <<= 9 - n;
}
-@@ -1686,6 +1719,9 @@
+@@ -1686,6 +1723,9 @@
}
for (n = 11; n <= 12; ++n) {
code = lookBits(n);
@@ -1579,7 +1714,7 @@
if (n < 12) {
code <<= 12 - n;
}
-@@ -1711,9 +1747,12 @@
+@@ -1711,9 +1751,12 @@
code = 0; // make gcc happy
if (endOfBlock) {
code = lookBits(13);
@@ -1593,7 +1728,7 @@
p = &blackTab2[(code >> 1) - 64];
} else {
p = &blackTab3[code >> 7];
-@@ -1725,6 +1764,9 @@
+@@ -1725,6 +1768,9 @@
} else {
for (n = 2; n <= 6; ++n) {
code = lookBits(n);
@@ -1603,7 +1738,7 @@
if (n < 6) {
code <<= 6 - n;
}
-@@ -1736,6 +1778,9 @@
+@@ -1736,6 +1782,9 @@
}
for (n = 7; n <= 12; ++n) {
code = lookBits(n);
@@ -1613,7 +1748,7 @@
if (n < 12) {
code <<= 12 - n;
}
-@@ -1749,6 +1794,9 @@
+@@ -1749,6 +1798,9 @@
}
for (n = 10; n <= 13; ++n) {
code = lookBits(n);
@@ -1623,7 +1758,7 @@
if (n < 13) {
code <<= 13 - n;
}
-@@ -1963,6 +2011,12 @@
+@@ -1963,6 +2015,12 @@
// allocate a buffer for the whole image
bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
@@ -1636,7 +1771,7 @@
for (i = 0; i < numComps; ++i) {
frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
-@@ -3038,6 +3092,11 @@
+@@ -3038,6 +3096,11 @@
}
scanInfo.firstCoeff = str->getChar();
scanInfo.lastCoeff = str->getChar();
@@ -1648,8 +1783,8 @@
c = str->getChar();
scanInfo.ah = (c >> 4) & 0x0f;
scanInfo.al = c & 0x0f;
---- misc/xpdf-3.02/xpdf/Stream.h Tue Feb 27 23:05:52 2007
-+++ misc/build/xpdf-3.02/xpdf/Stream.h Mon Apr 21 15:42:50 2008
+--- misc/xpdf-3.02/xpdf/Stream.h 2007-02-27 23:05:52.000000000 +0100
++++ misc/build/xpdf-3.02/xpdf/Stream.h 2009-11-10 11:43:10.426813566 +0100
@@ -528,13 +528,15 @@
int row; // current row
int inputBuf; // input buffer
@@ -1670,3 +1805,68 @@
short getTwoDimCode();
short getWhiteCode();
short getBlackCode();
+--- misc/xpdf-3.02/xpdf/XRef.cc 2007-02-27 23:05:52.000000000 +0100
++++ misc/build/xpdf-3.02/xpdf/XRef.cc 2009-11-10 11:43:54.923556696 +0100
+@@ -52,6 +52,8 @@
+ // generation 0.
+ ObjectStream(XRef *xref, int objStrNumA);
+
++ GBool isOk() { return ok; }
++
+ ~ObjectStream();
+
+ // Return the object number of this object stream.
+@@ -67,6 +69,7 @@
+ int nObjects; // number of objects in the stream
+ Object *objs; // the objects (length = nObjects)
+ int *objNums; // the object numbers (length = nObjects)
++ GBool ok;
+ };
+
+ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
+@@ -80,6 +83,7 @@
+ nObjects = 0;
+ objs = NULL;
+ objNums = NULL;
++ ok = gFalse;
+
+ if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) {
+ goto err1;
+@@ -105,6 +109,13 @@
+ goto err1;
+ }
+
++ // this is an arbitrary limit to avoid integer overflow problems
++ // in the 'new Object[nObjects]' call (Acrobat apparently limits
++ // object streams to 100-200 objects)
++ if (nObjects > 1000000) {
++ error(-1, "Too many objects in an object stream");
++ goto err1;
++ }
+ objs = new Object[nObjects];
+ objNums = (int *)gmallocn(nObjects, sizeof(int));
+ offsets = (int *)gmallocn(nObjects, sizeof(int));
+@@ -161,10 +172,10 @@
+ }
+
+ gfree(offsets);
++ ok = gTrue;
+
+ err1:
+ objStr.free();
+- return;
+ }
+
+ ObjectStream::~ObjectStream() {
+@@ -837,6 +848,11 @@
+ delete objStr;
+ }
+ objStr = new ObjectStream(this, e->offset);
++ if (!objStr->isOk()) {
++ delete objStr;
++ objStr = NULL;
++ goto err;
++ }
+ }
+ objStr->getObject(e->gen, num, obj);
+ break;