fixed type3 memory overflow

[swftools.git] / lib / pdf / xpdf-changes.patch

diff --git a/lib/pdf/xpdf-changes.patch b/lib/pdf/xpdf-changes.patch
index 0db8a51..42ff39f 100644 (file)
--- a/lib/pdf/xpdf-changes.patch
+++ b/lib/pdf/xpdf-changes.patch
@@ -1136,3 +1136,33 @@ diff -u -r1.5 -r1.6
      for (i = 15; i >= n; --i) {
        s->buf[i] = s->buf[i-n];
      }
+--- xpdf/Catalog.cc.orig       2010-02-02 16:17:24.000000000 -0800
++++ xpdf/Catalog.cc    2010-02-02 16:18:48.000000000 -0800
+@@ -193,7 +193,7 @@
+   if (!kids.isArray()) {
+     error(-1, "Kids object (page %d) is wrong type (%s)",
+         start+1, kids.getTypeName());
+-    goto err1;
++    return start;
+   }
+   for (i = 0; i < kids.arrayGetLength(); ++i) {
+     kids.arrayGetNF(i, &kidRef);
+--- xpdf/SplashOutputDev.cc.orig       2010-03-25 14:06:37.000000000 -0700
++++ xpdf/SplashOutputDev.cc    2010-03-25 14:07:23.000000000 -0700
+@@ -13,6 +13,7 @@
+@@ -509,7 +510,14 @@
+   glyphY = glyphYA;
+   glyphW = glyphWA;
+   glyphH = glyphHA;
+-  validBBox = validBBoxA;
++
++  if(glyphW<=0 || glyphH<=0 || (double)glyphH*(double)glyphW>536870912) {
++    glyphW = glyphH = 128;
++    validBBox = gFalse;
++  } else {
++    validBBox = validBBoxA;
++  }
++
+   if (aa) {
+     glyphSize = glyphW * glyphH;
+   } else {