+ // Return the path for a glyph.
+ virtual SplashPath *getGlyphPath(int c);
+
+--- xpdf/SplashFTFontEngine.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashFTFontEngine.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -13,9 +13,7 @@
+ #endif
+
+ #include <stdio.h>
+-#ifndef WIN32
+ # include <unistd.h>
+-#endif
+ #include "gmem.h"
+ #include "GString.h"
+ #include "gfile.h"
+--- xpdf/SplashFont.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashFont.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -48,6 +48,10 @@
+ cacheTags = NULL;
+
+ xMin = yMin = xMax = yMax = 0;
++
++ last_advance = -1;
++ ascender = -1;
++ descender = -1;
+ }
+
+ void SplashFont::initCache() {
+--- xpdf/SplashFont.h.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashFont.h 2010-05-18 11:22:18.000000000 -0700
+@@ -73,6 +73,9 @@
+ virtual GBool makeGlyph(int c, int xFrac, int yFrac,
+ SplashGlyphBitmap *bitmap) = 0;
+
++ // return the number of characters in this font
++ virtual int getNumChars() = 0;
++
+ // Return the path for a glyph.
+ virtual SplashPath *getGlyphPath(int c) = 0;
+
+@@ -83,6 +86,9 @@
+ void getBBox(int *xMinA, int *yMinA, int *xMaxA, int *yMaxA)
+ { *xMinA = xMin; *yMinA = yMin; *xMaxA = xMax; *yMaxA = yMax; }
+
++ double ascender;
++ double descender;
++ double last_advance; //set after getGlyphPath()
+ protected:
+
+ SplashFontFile *fontFile;
+--- xpdf/SplashFontFile.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashFontFile.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -11,9 +11,7 @@
+ #endif
+
+ #include <stdio.h>
+-#ifndef WIN32
+-# include <unistd.h>
+-#endif
++#include <unistd.h>
+ #include "GString.h"
+ #include "SplashFontFile.h"
+ #include "SplashFontFileID.h"
+--- xpdf/SplashOutputDev.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashOutputDev.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -13,6 +13,7 @@
+ #endif
+
+ #include <string.h>
++#include <unistd.h>
+ #include <math.h>
+ #include "gfile.h"
+ #include "GlobalParams.h"
+@@ -2646,9 +2647,9 @@
+
+ softMask = new SplashBitmap(bitmap->getWidth(), bitmap->getHeight(),
+ 1, splashModeMono8, gFalse);
+- memset(softMask->getDataPtr(), 0,
+- softMask->getRowSize() * softMask->getHeight());
++ memset(softMask->getDataPtr(), 0x00, softMask->getRowSize()*softMask->getHeight());
+ p = softMask->getDataPtr() + ty * softMask->getRowSize() + tx;
++ if (tx<softMask->getWidth() && ty<softMask->getHeight())
+ for (y = 0; y < tBitmap->getHeight(); ++y) {
+ for (x = 0; x < tBitmap->getWidth(); ++x) {
+ tBitmap->getPixel(x, y, color);
+--- xpdf/SplashOutputDev.h.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashOutputDev.h 2010-05-18 11:22:18.000000000 -0700
+@@ -196,6 +196,9 @@
+ virtual void setVectorAntialias(GBool vaa);
+ #endif
+
++ void doUpdateFont(GfxState *state);
++
++ SplashPath *convertPath(GfxState *state, GfxPath *path);
+ private:
+
+ void setupScreenParams(double hDPI, double vDPI);
+@@ -204,8 +207,6 @@
+ #else
+ SplashPattern *getColor(GfxGray gray, GfxRGB *rgb);
+ #endif
+- SplashPath *convertPath(GfxState *state, GfxPath *path);
+- void doUpdateFont(GfxState *state);
+ void drawType3Glyph(T3FontCache *t3Font,
+ T3FontCacheTag *tag, Guchar *data);
+ static GBool imageMaskSrc(void *data, SplashColorPtr line);
+--- xpdf/SplashScreen.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashScreen.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -363,6 +363,8 @@
+ int SplashScreen::test(int x, int y, Guchar value) {
+ int xx, yy;
+
++ return 1;
++
+ if (value < minVal) {
+ return 0;
+ }
+--- xpdf/SplashXPathScanner.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/SplashXPathScanner.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -394,10 +394,10 @@
+ *p++ &= mask;
+ xx = (xx & ~7) + 8;
+ }
+- for (; xx + 7 <= xx0; xx += 8) {
++ for (; xx + 7 < xx0; xx += 8) {
+ *p++ = 0x00;
+ }
+- if (xx <= xx0) {
++ if (xx < xx0) {
+ *p &= 0xff >> (xx0 & 7);
+ }
+ }
+@@ -417,10 +417,10 @@
+ *p++ &= mask;
+ xx = (xx & ~7) + 8;
+ }
+- for (; xx + 7 <= xx0; xx += 8) {
++ for (; xx + 7 < xx0; xx += 8) {
+ *p++ = 0x00;
+ }
+- if (xx <= xx0) {
++ if (xx < xx0) {
+ *p &= 0xff >> (xx0 & 7);
+ }
+ }
+--- xpdf/Stream.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/Stream.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -18,6 +18,8 @@
+ #include <limits.h>
+ #ifndef WIN32
+ #include <unistd.h>
++#else
++extern "C" int unlink(char *filename);
+ #endif
+ #include <string.h>
+ #include <ctype.h>
+@@ -2456,6 +2460,9 @@
+ // check for an EOB run
+ if (eobRun > 0) {
+ while (i <= scanInfo.lastCoeff) {
++ if(i>=64) {
++ return gFalse;
++ }
+ j = dctZigZag[i++];
+ if (data[j] != 0) {
+ if ((bit = readBit()) == EOF) {
+@@ -2480,6 +2487,9 @@
+ if (c == 0xf0) {
+ k = 0;
+ while (k < 16) {
++ if(i>=64) {
++ return gFalse;
++ }
+ j = dctZigZag[i++];
+ if (data[j] == 0) {
+ ++k;
+@@ -2505,6 +2515,9 @@
+ }
+ eobRun += 1 << j;
+ while (i <= scanInfo.lastCoeff) {
++ if(i>=64) {
++ return gFalse;
++ }
+ j = dctZigZag[i++];
+ if (data[j] != 0) {
+ if ((bit = readBit()) == EOF) {
+@@ -2527,6 +2540,9 @@
+ }
+ k = 0;
+ do {
++ if(i>=64) {
++ return gFalse;
++ }
+ j = dctZigZag[i++];
+ while (data[j] != 0) {
+ if ((bit = readBit()) == EOF) {
+@@ -2535,6 +2551,9 @@
+ if (bit) {
+ data[j] += 1 << scanInfo.al;
+ }
++ if(i>=64) {
++ return gFalse;
++ }
+ j = dctZigZag[i++];
+ }
+ ++k;
+--- xpdf/Stream.h.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/Stream.h 2010-05-18 11:22:18.000000000 -0700
+@@ -41,7 +41,8 @@
+ streamCSNone,
+ streamCSDeviceGray,
+ streamCSDeviceRGB,
+- streamCSDeviceCMYK
++ streamCSDeviceCMYK,
++ streamCSDeviceRGBX
+ };
+
+ //------------------------------------------------------------------------
+--- xpdf/TextOutputDev.h.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/TextOutputDev.h 2010-05-18 11:22:18.000000000 -0700
+@@ -170,6 +170,7 @@
+ friend class TextFlow;
+ friend class TextWordList;
+ friend class TextPage;
++ friend class XMLOutputDev;
+ };
+
+ //------------------------------------------------------------------------
+--- xpdf/gfile.cc.orig 2010-05-18 11:22:18.000000000 -0700
++++ xpdf/gfile.cc 2010-05-18 11:22:18.000000000 -0700
+@@ -439,6 +439,52 @@
+ #endif
+ }
+
++static char* getTempDir()
++{
++#ifdef WIN32
++ char*dir = getenv("TMP");
++ if(!dir) dir = getenv("TEMP");
++ if(!dir) dir = getenv("tmp");
++ if(!dir) dir = getenv("temp");
++ if(!dir) dir = "C:\\";
++#else
++ char* dir = "/tmp/";
++#endif
++ return dir;
++}
++
++char* mktmpname(char*ptr) {
++ static char tmpbuf[128];
++ char*dir = getTempDir();
++ int l = strlen(dir);
++ char*sep = "";
++ if(!ptr)
++ ptr = tmpbuf;
++ if(l && dir[l-1]!='/' && dir[l-1]!='\\') {
++#ifdef WIN32
++ sep = "\\";
++#else
++ sep = "/";
++#endif
++ }
++
++ // used to be mktemp. This does remove the warnings, but
++ // It's not exactly an improvement.
++#ifdef HAVE_LRAND48
++ sprintf(ptr, "%s%s%08x%08x",dir,sep,(unsigned int)lrand48(),(unsigned int)lrand48());
++#else
++# ifdef HAVE_RAND
++ sprintf(ptr, "%s%s%08x%08x",dir,sep,rand(),rand());
++# else
++ static int count = 1;
++ sprintf(ptr, "%s%s%08x%04x%04x",dir,sep,time(0),(unsigned int)tmpbuf^((unsigned int)tmpbuf)>>16,count);
++ count ++;
++# endif
++#endif
++ return ptr;
++}
++
++
+ GBool openTempFile(GString **name, FILE **f, char *mode, char *ext) {
+ #if defined(WIN32)