if (!strcmp(tok3, "[")) {
i = 0;
while (pst->getToken(tok1, sizeof(tok1), &n1) &&
+--- xpdf/Decrypt.cc.orig 2010-01-28 14:19:51.000000000 -0800
++++ xpdf/Decrypt.cc 2010-02-02 16:04:53.000000000 -0800
+@@ -596,6 +596,7 @@
+ s->bufIdx = 0;
+ if (last) {
+ n = s->buf[15];
++ if(!n || n>16) n=16;
+ for (i = 15; i >= n; --i) {
+ s->buf[i] = s->buf[i-n];
+ }
+--- xpdf/Catalog.cc.orig 2010-02-02 16:17:24.000000000 -0800
++++ xpdf/Catalog.cc 2010-02-02 16:18:48.000000000 -0800
+@@ -193,7 +193,7 @@
+ if (!kids.isArray()) {
+ error(-1, "Kids object (page %d) is wrong type (%s)",
+ start+1, kids.getTypeName());
+- goto err1;
++ return start;
+ }
+ for (i = 0; i < kids.arrayGetLength(); ++i) {
+ kids.arrayGetNF(i, &kidRef);
+--- xpdf/SplashOutputDev.cc.orig 2010-03-25 14:06:37.000000000 -0700
++++ xpdf/SplashOutputDev.cc 2010-03-25 14:07:23.000000000 -0700
+@@ -13,6 +13,7 @@
+@@ -509,7 +510,14 @@
+ glyphY = glyphYA;
+ glyphW = glyphWA;
+ glyphH = glyphHA;
+- validBBox = validBBoxA;
++
++ if(glyphW<=0 || glyphH<=0 || (double)glyphH*(double)glyphW>536870912) {
++ glyphW = glyphH = 128;
++ validBBox = gFalse;
++ } else {
++ validBBox = validBBoxA;
++ }
++
+ if (aa) {
+ glyphSize = glyphW * glyphH;
+ } else {