From 7dff01be4c5c03eb4908285a751a8b5e03054c48 Mon Sep 17 00:00:00 2001
From: Matthias Kramm <kramm@quiss.org>
Date: Thu, 25 Mar 2010 14:10:19 -0700
Subject: [PATCH 1/1] fixed type3 memory overflow

---
 lib/pdf/xpdf-changes.patch |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/pdf/xpdf-changes.patch b/lib/pdf/xpdf-changes.patch
index affe897..42ff39f 100644
--- a/lib/pdf/xpdf-changes.patch
+++ b/lib/pdf/xpdf-changes.patch
@@ -1147,3 +1147,22 @@ diff -u -r1.5 -r1.6
    }
    for (i = 0; i < kids.arrayGetLength(); ++i) {
      kids.arrayGetNF(i, &kidRef);
+--- xpdf/SplashOutputDev.cc.orig	2010-03-25 14:06:37.000000000 -0700
++++ xpdf/SplashOutputDev.cc	2010-03-25 14:07:23.000000000 -0700
+@@ -13,6 +13,7 @@
+@@ -509,7 +510,14 @@
+   glyphY = glyphYA;
+   glyphW = glyphWA;
+   glyphH = glyphHA;
+-  validBBox = validBBoxA;
++
++  if(glyphW<=0 || glyphH<=0 || (double)glyphH*(double)glyphW>536870912) {
++    glyphW = glyphH = 128;
++    validBBox = gFalse;
++  } else {
++    validBBox = validBBoxA;
++  }
++
+   if (aa) {
+     glyphSize = glyphW * glyphH;
+   } else {
-- 
1.7.10.4