[pkg-kde-commits] rev 2685 -
branches/kde-3.4.0/packages/kdegraphics/debian/patches
Christopher Martin
chrsmrtn at costa.debian.org
Tue Dec 20 16:13:52 UTC 2005
Author: chrsmrtn
Date: 2005-12-20 16:13:51 +0000 (Tue, 20 Dec 2005)
New Revision: 2685
Added:
branches/kde-3.4.0/packages/kdegraphics/debian/patches/01_kdegraphics_branch_r490047.diff
Log:
New kdegraphics branch pull. xpdf fixes.
Added: branches/kde-3.4.0/packages/kdegraphics/debian/patches/01_kdegraphics_branch_r490047.diff
===================================================================
--- branches/kde-3.4.0/packages/kdegraphics/debian/patches/01_kdegraphics_branch_r490047.diff 2005-12-20 09:30:42 UTC (rev 2684)
+++ branches/kde-3.4.0/packages/kdegraphics/debian/patches/01_kdegraphics_branch_r490047.diff 2005-12-20 16:13:51 UTC (rev 2685)
@@ -0,0 +1,243 @@
+#DPATCHLEVEL=0
+--- kpdf/xpdf/xpdf/JBIG2Stream.cc (revision 486446)
++++ kpdf/xpdf/xpdf/JBIG2Stream.cc (revision 490047)
+@@ -7,6 +7,7 @@
+ //========================================================================
+
+ #include <aconf.h>
++#include <limits.h>
+
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,6 +682,13 @@
+ w = wA;
+ h = hA;
+ line = (wA + 7) >> 3;
++
++ if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++ error(-1, "invalid width/height");
++ data = NULL;
++ return;
++ }
++
+ data = (Guchar *)gmalloc(h * line);
+ }
+
+@@ -690,6 +698,13 @@
+ w = bitmap->w;
+ h = bitmap->h;
+ line = bitmap->line;
++
++ if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++ error(-1, "invalid width/height");
++ data = NULL;
++ return;
++ }
++
+ data = (Guchar *)gmalloc(h * line);
+ memcpy(data, bitmap->data, h * line);
+ }
+@@ -716,7 +731,10 @@
+ }
+
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+- if (newH <= h) {
++ if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
++ error(-1, "invalid width/height");
++ gfree(data);
++ data = NULL;
+ return;
+ }
+ data = (Guchar *)grealloc(data, newH * line);
+@@ -2256,6 +2274,15 @@
+ error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+ return;
+ }
++ if (gridH == 0 || gridW >= INT_MAX / gridH) {
++ error(getPos(), "Bad size in JBIG2 halftone segment");
++ return;
++ }
++ if (w == 0 || h >= INT_MAX / w) {
++ error(getPos(), "Bad size in JBIG2 bitmap segment");
++ return;
++ }
++
+ patternDict = (JBIG2PatternDict *)seg;
+ bpp = 0;
+ i = 1;
+@@ -2887,6 +2914,11 @@
+ JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+ int x, y, pix;
+
++ if (w < 0 || h <= 0 || w >= INT_MAX / h) {
++ error(-1, "invalid width/height");
++ return NULL;
++ }
++
+ bitmap = new JBIG2Bitmap(0, w, h);
+ bitmap->clearToZero();
+
+--- kpdf/xpdf/xpdf/Stream.cc (revision 486446)
++++ kpdf/xpdf/xpdf/Stream.cc (revision 490047)
+@@ -15,6 +15,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <stddef.h>
++#include <limits.h>
+ #ifndef WIN32
+ #include <unistd.h>
+ #endif
+@@ -408,8 +409,6 @@
+
+ StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
+ int widthA, int nCompsA, int nBitsA) {
+- int totalBits;
+-
+ str = strA;
+ predictor = predictorA;
+ width = widthA;
+@@ -418,18 +417,19 @@
+ predLine = NULL;
+ ok = gFalse;
+
++ if (width <= 0 || nComps <= 0 || nBits <= 0 ||
++ nComps >= INT_MAX / nBits ||
++ width >= INT_MAX / nComps / nBits)
++ return;
++
+ nVals = width * nComps;
+- totalBits = nVals * nBits;
+- if (totalBits == 0 ||
+- (totalBits / nBits) / nComps != width ||
+- totalBits + 7 < 0) {
++ if (nVals * nBits + 7 <= 0)
+ return;
+- }
+ pixBytes = (nComps * nBits + 7) >> 3;
+- rowBytes = ((totalBits + 7) >> 3) + pixBytes;
+- if (rowBytes < 0) {
++ rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
++ if (rowBytes < 0)
+ return;
+- }
++
+ predLine = (Guchar *)gmalloc(rowBytes);
+ memset(predLine, 0, rowBytes);
+ predIdx = rowBytes;
+@@ -1280,6 +1280,10 @@
+ endOfLine = endOfLineA;
+ byteAlign = byteAlignA;
+ columns = columnsA;
++ if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++ error(-1, "invalid number of columns");
++ exit(1);
++ }
+ rows = rowsA;
+ endOfBlock = endOfBlockA;
+ black = blackA;
+@@ -2919,6 +2923,7 @@
+ width = read16();
+ numComps = str->getChar();
+ if (numComps <= 0 || numComps > 4) {
++ numComps = 0;
+ error(getPos(), "Bad number of components in DCT stream");
+ return gFalse;
+ }
+@@ -2948,6 +2953,11 @@
+ height = read16();
+ width = read16();
+ numComps = str->getChar();
++ if (numComps <= 0 || numComps > 4) {
++ numComps = 0;
++ error(getPos(), "Bad number of components in DCT stream");
++ return gFalse;
++ }
+ if (prec != 8) {
+ error(getPos(), "Bad DCT precision %d", prec);
+ return gFalse;
+@@ -2970,6 +2980,11 @@
+
+ length = read16() - 2;
+ scanInfo.numComps = str->getChar();
++ if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++ scanInfo.numComps = 0;
++ error(getPos(), "Bad number of components in DCT stream");
++ return gFalse;
++ }
+ --length;
+ if (length != 2 * scanInfo.numComps + 3) {
+ error(getPos(), "Bad DCT scan info block");
+@@ -3044,12 +3059,12 @@
+ while (length > 0) {
+ index = str->getChar();
+ --length;
+- if ((index & 0x0f) >= 4) {
++ if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+ error(getPos(), "Bad DCT Huffman table");
+ return gFalse;
+ }
+ if (index & 0x10) {
+- index &= 0x0f;
++ index &= 0x03;
+ if (index >= numACHuffTables)
+ numACHuffTables = index+1;
+ tbl = &acHuffTables[index];
+@@ -3167,9 +3182,11 @@
+ do {
+ do {
+ c = str->getChar();
++ if(c == EOF) return EOF;
+ } while (c != 0xff);
+ do {
+ c = str->getChar();
++ if(c == EOF) return EOF;
+ } while (c == 0xff);
+ } while (c == 0x00);
+ return c;
+--- kpdf/xpdf/xpdf/JPXStream.cc (revision 486446)
++++ kpdf/xpdf/xpdf/JPXStream.cc (revision 490047)
+@@ -7,6 +7,7 @@
+ //========================================================================
+
+ #include <aconf.h>
++#include <limits.h>
+
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -702,7 +703,7 @@
+ img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
+ / img.yTileSize;
+ nTiles = img.nXTiles * img.nYTiles;
+- if (img.nXTiles == 0 || nTiles / img.nXTiles != img.nYTiles) {
++ if (img.nXTiles <= 0 || img.nYTiles <= 0 || img.nXTiles >= INT_MAX / img.nYTiles) {
+ error(getPos(), "Bad tile count in JPX SIZ marker segment");
+ return gFalse;
+ }
+--- kpdf/xpdf/goo/gmem.c (revision 486446)
++++ kpdf/xpdf/goo/gmem.c (revision 490047)
+@@ -11,6 +11,7 @@
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <string.h>
++#include <limits.h>
+ #include "gmem.h"
+
+ #ifdef DEBUG_MEM
+@@ -179,7 +180,7 @@
+ int n;
+
+ n = nObjs * objSize;
+- if (objSize == 0 || n / objSize != nObjs) {
++ if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+ fprintf(stderr, "Bogus memory allocation size\n");
+ exit(1);
+ }
+@@ -190,7 +191,7 @@
+ int n;
+
+ n = nObjs * objSize;
+- if (objSize == 0 || n / objSize != nObjs) {
++ if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+ fprintf(stderr, "Bogus memory allocation size\n");
+ exit(1);
+ }
More information about the pkg-kde-commits
mailing list