poppler 0.66.0

git-svn-id: svn://tug.org/texlive/trunk@48060 c570f23f-e606-0410-a88d-b1316a301751

31 files changed, 1232 insertions, 113 deletions

diff --git a/Build/source/libs/README b/Build/source/libs/README
index 7f4cffc658c..1d55f12d00b 100644
--- a/Build/source/libs/README
+++ b/Build/source/libs/README
@@ -49,7 +49,7 @@ mpfr 4.0.1 - checked 10feb18
 pixman 0.34.0 - checked 04feb16
   http://cairographics.org/releases/
 
-poppler 0.65.0 - checked 21may18
+poppler 0.66.0 - checked 20jun18
   http://poppler.freedesktop.org/ - used by luatex and xetex
   (requires C++11)
 
diff --git a/Build/source/libs/poppler/ChangeLog b/Build/source/libs/poppler/ChangeLog
index 561ba1d21cd..43faadaf6b8 100644
--- a/Build/source/libs/poppler/ChangeLog
+++ b/Build/source/libs/poppler/ChangeLog
@@ -1,3 +1,8 @@
+2018-06-20  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
+
+	Import poppler-0.66.0.
+	* version.ac: Adjust.
+
 2018-05-21  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
 
 	Import poppler-0.65.0.
diff --git a/Build/source/libs/poppler/TLpatches/ChangeLog b/Build/source/libs/poppler/TLpatches/ChangeLog
index 88096140b2d..95d2ceb3092 100644
--- a/Build/source/libs/poppler/TLpatches/ChangeLog
+++ b/Build/source/libs/poppler/TLpatches/ChangeLog
@@ -1,3 +1,7 @@
+2018-06-20  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
+
+	* patch-03-time: Adapted.
+
 2018-05-21  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
 
 	* patch-03-time: Adapted.
diff --git a/Build/source/libs/poppler/TLpatches/TL-Changes b/Build/source/libs/poppler/TLpatches/TL-Changes
index 7b206957677..492028e489e 100644
--- a/Build/source/libs/poppler/TLpatches/TL-Changes
+++ b/Build/source/libs/poppler/TLpatches/TL-Changes
@@ -1,4 +1,4 @@
-Changes applied to the poppler-0.65.0 tree as obtained from:
+Changes applied to the poppler-0.66.0 tree as obtained from:
 	http://poppler.freedesktop.org/
 
 Removed unused dirs:
@@ -11,7 +11,7 @@ General idea:
 update version.ac
 mv poppler-src poppler-prev
 tar xf poppler-*.tar.gz
-mv poppler-0.65.0 poppler-src
+mv poppler-0.66.0 poppler-src
 cd poppler-src
 svn status >/tmp/s
 svn add # the ? lines
diff --git a/Build/source/libs/poppler/TLpatches/patch-03-time b/Build/source/libs/poppler/TLpatches/patch-03-time
index aa37759f0f6..ff510f42f21 100644
--- a/Build/source/libs/poppler/TLpatches/patch-03-time
+++ b/Build/source/libs/poppler/TLpatches/patch-03-time
@@ -1,6 +1,6 @@
-diff -ur poppler-0.65.0/goo/gfile.h poppler-src/goo/gfile.h
---- poppler-0.65.0/goo/gfile.h	Sun May 20 00:05:25 2018
-+++ poppler-src/goo/gfile.h	Mon May 21 13:30:39 2018
+diff -ur poppler-0.66.0/goo/gfile.h poppler-src/goo/gfile.h
+--- poppler-0.66.0/goo/gfile.h	Wed Jun 20 06:16:47 2018
++++ poppler-src/goo/gfile.h	Wed Jun 20 14:32:44 2018
 @@ -51,8 +51,6 @@
  #    include <windows.h>
  #  endif
@@ -10,9 +10,9 @@ diff -ur poppler-0.65.0/goo/gfile.h poppler-src/goo/gfile.h
  #else
  #  include <unistd.h>
  #  include <sys/types.h>
-diff -ur poppler-0.65.0/poppler/Form.h poppler-src/poppler/Form.h
---- poppler-0.65.0/poppler/Form.h	Sun May 20 00:05:25 2018
-+++ poppler-src/poppler/Form.h	Mon May 21 13:31:30 2018
+diff -ur poppler-0.66.0/poppler/Form.h poppler-src/poppler/Form.h
+--- poppler-0.66.0/poppler/Form.h	Wed Jun 20 06:16:47 2018
++++ poppler-src/poppler/Form.h	Wed Jun 20 14:31:47 2018
 @@ -36,6 +36,7 @@
  
  #include <set>
diff --git a/Build/source/libs/poppler/configure b/Build/source/libs/poppler/configure
index 971aa9a6d58..7062703388d 100755
--- a/Build/source/libs/poppler/configure
+++ b/Build/source/libs/poppler/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for poppler (TeX Live) 0.65.0.
+# Generated by GNU Autoconf 2.69 for poppler (TeX Live) 0.66.0.
 #
 # Report bugs to <tex-k@tug.org>.
 #
@@ -580,8 +580,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='poppler (TeX Live)'
 PACKAGE_TARNAME='poppler--tex-live-'
-PACKAGE_VERSION='0.65.0'
-PACKAGE_STRING='poppler (TeX Live) 0.65.0'
+PACKAGE_VERSION='0.66.0'
+PACKAGE_STRING='poppler (TeX Live) 0.66.0'
 PACKAGE_BUGREPORT='tex-k@tug.org'
 PACKAGE_URL=''
 
@@ -1307,7 +1307,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures poppler (TeX Live) 0.65.0 to adapt to many kinds of systems.
+\`configure' configures poppler (TeX Live) 0.66.0 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1374,7 +1374,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of poppler (TeX Live) 0.65.0:";;
+     short | recursive ) echo "Configuration of poppler (TeX Live) 0.66.0:";;
    esac
   cat <<\_ACEOF
 
@@ -1487,7 +1487,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-poppler (TeX Live) configure 0.65.0
+poppler (TeX Live) configure 0.66.0
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2134,7 +2134,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by poppler (TeX Live) $as_me 0.65.0, which was
+It was created by poppler (TeX Live) $as_me 0.66.0, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4057,7 +4057,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='poppler--tex-live-'
- VERSION='0.65.0'
+ VERSION='0.66.0'
 
 
 # Some tools Automake needs.
@@ -7647,7 +7647,7 @@ ac_config_headers="$ac_config_headers poppler-config.h:poppler-src/poppler/poppl
 
 
 cat >>confdefs.h <<_ACEOF
-#define POPPLER_VERSION "0.65.0"
+#define POPPLER_VERSION "0.66.0"
 _ACEOF
 
 
@@ -8341,7 +8341,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by poppler (TeX Live) $as_me 0.65.0, which was
+This file was extended by poppler (TeX Live) $as_me 0.66.0, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -8407,7 +8407,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-poppler (TeX Live) config.status 0.65.0
+poppler (TeX Live) config.status 0.66.0
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/Build/source/libs/poppler/poppler-src/CMakeLists.txt b/Build/source/libs/poppler/poppler-src/CMakeLists.txt
index b5a86a5fde5..7b94037b6f1 100644
--- a/Build/source/libs/poppler/poppler-src/CMakeLists.txt
+++ b/Build/source/libs/poppler/poppler-src/CMakeLists.txt
@@ -30,7 +30,7 @@ if (ECM_FOUND)
 endif()
 
 set(POPPLER_MAJOR_VERSION "0")
-set(POPPLER_MINOR_VERSION "65")
+set(POPPLER_MINOR_VERSION "66")
 set(POPPLER_MICRO_VERSION "0")
 set(POPPLER_VERSION "${POPPLER_MAJOR_VERSION}.${POPPLER_MINOR_VERSION}.${POPPLER_MICRO_VERSION}")
 
@@ -490,7 +490,7 @@ add_library(poppler STATIC ${poppler_SRCS})
 else()
 add_library(poppler ${poppler_SRCS})
 endif()
-set_target_properties(poppler PROPERTIES VERSION 76.0.0 SOVERSION 76)
+set_target_properties(poppler PROPERTIES VERSION 77.0.0 SOVERSION 77)
 if(MINGW)
     get_target_property(POPPLER_SOVERSION poppler SOVERSION)
     set_target_properties(poppler PROPERTIES SUFFIX "-${POPPLER_SOVERSION}${CMAKE_SHARED_LIBRARY_SUFFIX}")
diff --git a/Build/source/libs/poppler/poppler-src/ChangeLog b/Build/source/libs/poppler/poppler-src/ChangeLog
index d223f64a791..022b69a02cb 100644
--- a/Build/source/libs/poppler/poppler-src/ChangeLog
+++ b/Build/source/libs/poppler/poppler-src/ChangeLog
@@ -1,3 +1,990 @@
+commit 877dcec7e2357991d79508a2aefc39d1510bf235
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 19 23:16:47 2018 +0200
+
+    Poppler 0.66
+
+ CMakeLists.txt   | 4 ++--
+ NEWS             | 7 +++++++
+ cpp/Doxyfile     | 2 +-
+ qt5/src/Doxyfile | 2 +-
+ 4 files changed, 11 insertions(+), 4 deletions(-)
+
+commit 37d2aa88409429397a6c8801b34213f6eded8e1e
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 19 17:42:16 2018 +0200
+
+    PostScriptFunction::parseCode: Fix memory leak on malformed files
+
+    Fixes oss-fuzz/8859
+
+ poppler/Function.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit e4f4cbddd11ae6386985879187007fa5add43624
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 12 09:32:57 2018 +0200
+
+    StreamPredictor: Move pixBytes calculation after checks
+
+    fixes oss-fuzz/8835
+
+ poppler/Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit adb7cac1b787b35c4f5d25e0441e459ab92d0469
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 12 09:00:33 2018 +0200
+
+    GfxImageColorMap: Initialize y to prevent uninit mem use
+
+    Fixes oss-fuzz/8839
+
+ poppler/GfxState.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 6b37df791731e40837fa1eba86ae740650431438
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed Jun 6 17:56:27 2018 +0200
+
+    SampledFunction: Fix divide by zero
+
+    Actual valid values are 1, 2, 4, 8, 12, 16, 24, and 32 but this
+    check is easier
+
+    fixes oss-fuzz/8713
+
+ poppler/Function.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit d6a3dc3ebbc97fcdd3c45028b5741f4b99fc0279
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed Jun 6 17:46:17 2018 +0200
+
+    GfxAxialShading::parse: Fix memory leak on broken files
+
+    fixes oss-fuzz/8742
+
+ poppler/GfxState.cc | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+commit 599e28433268ceaa933cf2a2492c81da4418e207
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 5 20:11:19 2018 +0200
+
+    JBIG2Stream::readSymbolDictSeg: Fix potential uninitialized memory
+    read
+
+    fixes oss-fuzz/8748
+
+ poppler/JBIG2Stream.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit a231de883b438af1807726fab4265ecf4689cf50
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 5 20:00:03 2018 +0200
+
+    CMap::parse2: Initialize end
+
+    fixes oss-fuzz/8747
+
+ poppler/CMap.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 2c629fefe2b2b1e2663521beeac432c808afe7c7
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue Jun 5 19:56:53 2018 +0200
+
+    JBIG2Stream::readSymbolDictSeg: Initialize dh
+
+    fixes oss-fuzz/8751
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 0053966d3ec5b5c4eb6480417b2c8a8ccd910964
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Mon Jun 4 20:38:41 2018 +0200
+
+    JBIG2Stream::readSymbolDictSeg: Initialize refDX
+
+    fixes oss-fuzz/8696
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 8dfe3fb37ec01e35eb22a0932fe708bc9b78cb4f
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 30 17:09:16 2018 +0200
+
+    LONG_LONG_MAX -> LLONG_MAX
+
+    that's the name the standard uses
+
+ poppler/Parser.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit b4f0e2b27a0880801c7af0c82fe17894797511b2
+Author: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Date:   Sat May 26 19:51:20 2018 +0200
+
+    Splash: Reserve space for path segments upfront
+
+    Instead of iteratively growing the array reserve sufficient space
+    prior to populating the array.
+
+ poppler/SplashOutputDev.cc |  2 ++
+ splash/SplashPath.cc       | 18 ++++++++++++++++++
+ splash/SplashPath.h        |  4 ++++
+ 3 files changed, 24 insertions(+)
+
+commit 450a8a54e080b5bb80533b1777b3b670bea1f27a
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 30 09:09:12 2018 +0200
+
+    JBIG2Stream::readSymbolDictSeg: Initialize refDY
+
+    fixes oss-fuzz/8621
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 1750c0155762e75d0a80ab55b50d1bfd172c2430
+Author: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Date:   Tue May 29 23:49:05 2018 +0200
+
+    splash: Correctly manipulate spot colors if SPOT_NCOMPS != 4
+
+    The default number of spot colors is 4, in this case the change is
+    without effect, otherwise only the last 4 colors where handled.
+
+ splash/SplashTypes.h | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+commit fb4629eb4b1787332b88b330da16353e5ade7b4d
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 29 20:32:23 2018 +0200
+
+    SplashFTFont: Early return if face->units_per_EM is 0
+
+    fixes oss-fuzz/8617
+
+ splash/SplashFTFont.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 943a465d7b76b26de83d2038226c72bcf619c29f
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 29 20:23:51 2018 +0200
+
+    SplashFTFont: Initialize textScale
+
+    fixes oss-fuzz/8616
+
+ splash/SplashFTFont.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit f821faa1795c1b25104d84e9f5a7e8ad218baa61
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 29 20:18:26 2018 +0200
+
+    CMap::parse2: Initialize start
+
+    fixes oss-fuzz/8611
+
+ poppler/CMap.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit a76c8fbd50a3a5cbe0487158e9d2b325e596d2c6
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 29 01:01:26 2018 +0200
+
+    GfxSeparationColorSpace::getRGB: ensure color2 doesn't have uninit
+    values
+
+    if alt->getNComps() is bigger than func->getOutputSize() (which
+    is most
+    likely a faulty file) we init those indexes of color2 with 0
+
+    fixes oss-fuzz/8586
+
+ poppler/GfxState.cc | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit e35fdb1448b7860d697b9c2ec8bda49c7a8a3ae5
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 29 00:59:22 2018 +0200
+
+    JBIG2Stream::readTextRegion: Initialize ds
+
+    fixes oss-fuzz/8594
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit bb25c0d46f1f0e037805f0c6dde07f3ea9c9320c
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 29 00:55:28 2018 +0200
+
+    Gfx::doRadialShFill: Initialize colorA, colorB and colorC
+
+    fixes oss-fuzz/8587
+
+ poppler/Gfx.cc | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+commit b8cf8b04cbd1c0c5643cc77ed7b0b60525ecf080
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Mon May 28 23:51:32 2018 +0200
+
+    FoFiType1::parse: Don't copy to buf more than the available file
+
+    fixes oss-fuzz/8576
+
+ fofi/FoFiType1.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit 10a3dc2a9c92349e498ea36bb342b821dcfc9d76
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Mon May 28 17:44:34 2018 +0200
+
+    GfxState.cc: Fix undefined behaviour when compBits is 31
+
+    it's a technical issue since according to spec biggest
+    valid value for compBits is 16, but this is simpler imho
+
+    fixes oss-fuzz/8582
+
+ poppler/GfxState.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 96e7bc19ffcaf46d4cb69660ed040c09d46815d6
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Sun May 27 09:42:24 2018 +0200
+
+    JBIG2Stream::readTextRegion: Initialize a few variables
+
+    So if the stream is broken we don't use uninitialized variables
+
+    fixes oss-fuzz/8547
+
+ poppler/JBIG2Stream.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 9c0c538e8d1aa39cd136cfb8fe0fbfe1def5174d
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Sun May 27 09:34:16 2018 +0200
+
+    Gfx::doAxialShFill: initialize color1
+
+    fixes oss-fuzz/8546
+
+ poppler/Gfx.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 18f376c0dff184851b3ee4c05c40b4ee2c21da8c
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Sun May 27 09:29:49 2018 +0200
+
+    FoFiType1::parse: Fix reading past font length
+
+    fixes oss-fuzz/8545
+
+ fofi/FoFiType1.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit 19d3993f3f40b5113141d5a55acea307c174f1d3
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Sun May 27 09:10:05 2018 +0200
+
+    XRef::fetch: Don't try to fetch objects with negative offset
+
+    fixes oss-fuzz/8433
+
+ poppler/XRef.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 9a8d33246601dbd2bea98bb3404596848f71162a
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Sun May 27 08:47:19 2018 +0200
+
+    Splash::fillGlyph2: fix buffer overflow
+
+    Make sure xx / 8 + 1 is not out of bounds
+
+    fixes oss-fuzz/8422
+
+ splash/Splash.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 1bc71245fa88dc23dc355f926f50f04896739fff
+Author: Adam Reichold <adam.reichold@t-online.de>
+Date:   Sat May 26 11:54:41 2018 +0200
+
+    LZWStream: make inputBuf unsigned
+
+    since shifting negative numbers is undefined according to spec
+
+ poppler/Stream.cc | 6 +++---
+ poppler/Stream.h  | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+commit 68c5977980a60b2fbac0a5938e697cf09f37b0a2
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 23:06:53 2018 +0200
+
+    BaseCryptStream: Initialize all of objKey
+
+    fixes oss-fuzz/8493
+
+ poppler/Decrypt.cc | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+commit 14adecb9693345b7e3baa6dee05f5c88dde7952c
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 22:57:29 2018 +0200
+
+    Decrypt::md5: initialize x
+
+    When msgLen is small enough x would had initialized values for some
+    parts of the md5 calculation
+
+    fixes oss-fuzz/8492
+
+ poppler/Decrypt.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 71bb82bdecccc235e15255635cab2c31cce58e0e
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 22:52:31 2018 +0200
+
+    Gfx::doAxialShFill: initialize color0
+
+    fixes oss-fuzz/8470
+
+ poppler/Gfx.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit b245154fdebc9a78db163bc95959c6c8f5b4126f
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 22:46:22 2018 +0200
+
+    Parser::makeStream: Don't overflow length
+
+    fixes oss-fuzz/8499
+
+ poppler/Parser.cc | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+commit 86777478387577aee8242eb2f11932041e87eff5
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 19:44:50 2018 +0200
+
+    Splash::fillWithPattern: initialize pipe
+
+    Makes sure if things fail we're not painting with uninitialized memory
+
+    fixes oss-fuzz/8538
+
+ splash/Splash.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 97caec070090d112d4fb5b63dc433a34e214c7e5
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 19:38:19 2018 +0200
+
+    FoFiType1C::readTopDict: Return early if parsing fails
+
+    fixes oss-fuzz/8456
+
+ fofi/FoFiType1C.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 7e2189377bfaa0594e25eaba26aca47bea59f315
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 17:47:07 2018 +0200
+
+    GfxGouraudTriangleShading::parse: Add bounds check for compBits
+
+    The spec is much more strict on what is valid, but i'm only doing
+    a check so that the code doesn't break
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit fef32ba463a225618a967c541d939fd69e02f2dd
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 17:42:22 2018 +0200
+
+    GfxPatchMeshShading::parse: Add bounds check for compBits
+
+    The spec is much more strict on what is valid, but i'm only doing
+    a check so that the code doesn't break
+
+    fixes oss-fuzz/8445
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit 3b9d8025dbdfcfac94ede20b05d86d177393cde7
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 17:26:37 2018 +0200
+
+    Splash: Fix another potential uninitialized memory use
+
+    fixes oss-fuzz/8466
+
+ splash/Splash.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit 0e3b18a48c3907a49c51a0ceded6078a2fd790eb
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 17:06:13 2018 +0200
+
+    SplashUnivariatePattern::getColor: Fix potential uninitialized
+    memory read
+
+    If the GfxUnivariateShading doesn't provide enough bits of color
+    fill them with 0 as to not have random memory read
+
+    fixes oss-fuzz/8470
+
+ poppler/GfxState.cc        | 5 +++--
+ poppler/GfxState.h         | 4 +++-
+ poppler/SplashOutputDev.cc | 6 +++++-
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+commit c75500bf6b2af4b9a26467ce55d1f2879e916b79
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 16:41:36 2018 +0200
+
+    T3FontCache: change the order in which the overflow checks are done
+
+    fixes oss-fuzz/8479
+
+ poppler/SplashOutputDev.cc | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+commit 4ea7ac960d9ecb6a407d0e660312f5701d3dcd49
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 16:35:49 2018 +0200
+
+    SplashFTFont::getGlyphPath: early return if textScale == 0
+
+    fixes oss-fuzz/8529
+
+ splash/SplashFTFont.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit c1164653bd8d6bcb7da1d959634f63592a393235
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 16:26:44 2018 +0200
+
+    GfxGouraudTriangleShading::parse: Protect against coordBits <= 0
+
+    fixes oss-fuzz/8524
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit a7154bcc6aba5429dc6cc024bd90dae2f1d2d0c1
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Fri May 25 16:21:45 2018 +0200
+
+    XRef::readXRefTable: Rewrite overflow check
+
+    In a way that it doesn't depend on undefined behaviour
+
+    fixes oss-fuzz/8528
+
+ poppler/XRef.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit f966b9096d046aaee4891de11f74207218cc929b
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 23:58:41 2018 +0200
+
+    SplashOutputDev::drawSoftMaskedImage: Fix uninitialized memory read
+
+    It can happen that maskStr->doGetChars doesn't give us the number
+    of chars we wanted, if that happens just set the remainder to zero
+
+ poppler/SplashOutputDev.cc | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+commit b228892adb01f978d5e6045e1e61741bca1950d2
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 23:49:12 2018 +0200
+
+    Splash::blitImageClipped: initialize pixel
+
+    At least this way if the getPixels call we're not drawing random
+    memory
+    and thus we get a stable render which helps with regtests
+
+ splash/Splash.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 67be3708cc4dea9e03f5d0ce5b0214fff35748f2
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 23:29:55 2018 +0200
+
+    SplashFTFont::makeGlyph: Fix use of uninitialized data
+
+    caused by the bugfix to not divide by zero
+
+ splash/SplashFTFont.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit c758fc980834882528eeae82568494e46d189cc5
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 23:19:16 2018 +0200
+
+    FoFiType1::parse: Fix invalid memory access
+
+    Make sure there's enough line left before calling strncmp
+
+    fixes oss-fuzz/8425
+
+ fofi/FoFiType1.cc | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+commit 07318f3899248f67a58148b29a9555ff47a1b083
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 20:15:42 2018 +0200
+
+    StreamReader::cmp: Fix potential undefined behaviour
+
+    going outside an array range is technically undefined behaviour,
+    even if then after you go back in range with the next operation, so
+    we first calculate the diff and then add it to the array
+
+ fofi/FoFiIdentifier.cc | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+commit 6b91d37a704fb2b6fa9529d859c366c331327ab9
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 18:22:00 2018 +0200
+
+    SplashOutputDev: Fix memory leak on malformed files
+
+    i.e. SplashOutputDev::endTextObject is not called after
+    SplashOutputDev::drawChar
+
+    fixes oss-fuzz/8508
+
+ poppler/SplashOutputDev.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit c9650369c5dd74812db515d986ded898b9002ae4
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 18:20:12 2018 +0200
+
+    Splash::scaleMaskYuXu: Free internal bitmap data on error
+
+    this way we don't try to use it later, which will be an uninitialized
+    memory read
+
+    fixes oss-fuzz/8511
+
+ splash/Splash.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit f279778fe0aca610cdecb70d0a714bbaa08b0d22
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 13:06:00 2018 +0200
+
+    JBIG2Stream::readSymbolDictSeg: Fix potential uninitialized memory use
+
+    fixes oss-fuzz/8468
+
+ poppler/JBIG2Stream.cc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+commit ea72a3f3dc1619482ab2502dc50fe628600f38b5
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 12:42:54 2018 +0200
+
+    gmallocn: move the operation after the checks
+
+    fixes oss-fuzz/8423
+
+ goo/gmem.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit aa39d079dc3b68b0a3512408706d053d664d557d
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 12:40:38 2018 +0200
+
+    XRef::readXRefStreamSection: Add integer overflow check
+
+    fixes oss-fuzz/8444
+
+ poppler/XRef.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit db73587c566f8e50f03b24628e8948a558ee7039
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 11:56:39 2018 +0200
+
+    StreamPredictor: move rowBytes calculation after overflow check
+
+    fixes oss-fuzz/8498
+
+ poppler/Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 76820f5ab932a9ed18913bc7d1a452ddf060c133
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Thu May 24 01:12:07 2018 +0200
+
+    JBIG2Stream::readPageInfoSeg: Fix memory leak on malformed documents
+
+    fixes oss-fuzz/8463
+
+ poppler/JBIG2Stream.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit ffb0daefda688564c1456f4b8b3f5a715d228cdc
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 19:06:51 2018 +0200
+
+    Apply previous optimization also to Splash::pipeRunAARGB8
+
+ splash/Splash.cc | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+commit f47936af75088c55a19fe6b1a67128fcc3f57b08
+Author: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Date:   Wed May 23 19:05:50 2018 +0200
+
+    Small optimization for AAXRGB8 pipes
+
+    Skip some computations if both src and dest alpha are zero, or if
+    src is fully opaque. For common cases (majority of pixels fully
+    opaque) like in fdo#81211, this reduces execution time of
+    pipeRunAAXBGR8 by 50% (-20% total execution time).
+
+ splash/Splash.cc | 29 ++++++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+commit 60ec88b3ca5f109b3532dbf2f36df66aed2d7bbf
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 19:49:29 2018 +0200
+
+    greallocn: move the operation to after the checks
+
+    fixes oss-fuzz/8484
+
+ goo/gmem.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit e0fb18040378659c98fedb4bdaff6a903ddd095b
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 19:40:50 2018 +0200
+
+    Gfx::opSetExtGState: Fix memory leak on broken files
+
+    doSoftMask was called just once, from opSetExtGState, but was
+    given the duty to delete blendingColorSpace that given doSoftMask
+    has various early returns is hard to do right, so i've moved
+    the deletion to opSetExtGState itself
+
+    fixes oss-fuzz/8431
+
+ poppler/Gfx.cc | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+commit 86991adb172fd55decdc72ec6fc34d41b19beafa
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 19:35:27 2018 +0200
+
+    Gfx::doRadialShFill: Fix potential divide by zero
+
+    fixes oss-fuzz/8476
+
+ poppler/Gfx.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 62c7a6a135aa8c70f638bac9b41a11c4e69c8452
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 19:29:39 2018 +0200
+
+    GfxImageColorMap::GfxImageColorMap: Bail out early if bits <= 0
+
+    fixes oss-fuzz/8478
+
+ poppler/GfxState.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 6e2de368f620d2e459a4cfe6533a8c29fae6d8c9
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 19:21:30 2018 +0200
+
+    SplashFTFont::SplashFTFont: Early return if textScale is 0
+
+    fixes oss-fuzz/8482
+
+ splash/SplashFTFont.cc | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit 8d715bfc7c3610b823721dc26368728795baa2fe
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 15:44:05 2018 +0200
+
+    GfxPatchMeshShading::parse: Error out if BitsPerCoordinate <= 0
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit f5fb32bd4b64040dc0f9b9e1555dabce804ba566
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 15:38:26 2018 +0200
+
+    Splash::scaleMaskYuXu: Also check for srcHeight <= 0
+
+ splash/Splash.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 0318e1667c7b137493f22be61b835eb914f68fa9
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 15:34:32 2018 +0200
+
+    GfxPatchMeshShading::parse: Fix memory leak on malformed documents
+
+    fixes oss-fuzz/8487
+
+ poppler/GfxState.cc | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+commit 3ca2d43b7ddcca08bc026c6564f89ffbe0dde506
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 00:27:08 2018 +0200
+
+    warning--
+
+ poppler/Decrypt.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 58e056c4b15f262b7715f8061d6885eb80044d0d
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Wed May 23 00:23:19 2018 +0200
+
+    Revert 31c3832b996acbf04ea833e304d7d21ac4533a57
+
+    So shifting left negative values is undefined behaviour according
+    to the
+    spec but if we don't do it we break, so we seem to be depending
+    on this
+    undefined behaviour, will try to figure out a better fix
+
+ poppler/Stream.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit a6c2eb671f08beb682e086d5f6791fdb78906a7c
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 22:12:03 2018 +0200
+
+    Make sure dash[i] is intialized
+
+    even if obj is not a number
+
+    fixes oss-fuzz/8462
+
+ poppler/Gfx.cc | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+commit 083bfa59378be1c008cb6543f7e9bebde29a4079
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 22:01:35 2018 +0200
+
+    nBitsDiffObjects can only be 32 as per spec
+
+    fixes oss-fuzz/8464
+
+ poppler/Hints.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 942a426f2844b66758b6b443234c3686d61420cc
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 21:41:51 2018 +0200
+
+    Parser::makeStream: Make sure length is not negative
+
+    fixes oss-fuzz/8469
+
+ poppler/Parser.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit bf03344ad26b1227b5052420feabe062441c02ed
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 20:36:05 2018 +0200
+
+    StandardSecurityHandler::isUnencrypted: Fix uninitialized memory use
+
+    fixes oss-fuzz/8426
+
+ poppler/SecurityHandler.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 31c3832b996acbf04ea833e304d7d21ac4533a57
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 20:25:18 2018 +0200
+
+    LZWStream::getCode: Don't left shift negative values
+
+    it's undefined behaviour
+
+ poppler/Stream.cc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+commit 2c0a0b07fdb2c76487ca4af7b2f50da9904c6c23
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 20:15:39 2018 +0200
+
+    Gfx::doImage: Fix memory leak on malformed documents
+
+    fixes oss-fuzz/8452
+
+ poppler/Gfx.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit ace7ca3e0dd1570ef6804c0f054742b2996b9b9f
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 20:10:01 2018 +0200
+
+    SplashAxialPattern: fix potential divide by zero
+
+ poppler/SplashOutputDev.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 3b8634e744aa5ba3b317fd3378ba07a438826827
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 20:07:50 2018 +0200
+
+    GfxAxialShading::getParameterRange: Fix potential divide by zero
+
+    fixes oss-fuzz/8436
+
+ poppler/GfxState.cc | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit 91079d4f482b35f190a4f2bbd9f4fb6a8ad7c2a2
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 20:01:56 2018 +0200
+
+    SampledFunction: Fix potential divide by zero
+
+    fixes oss-fuzz/8455
+
+ poppler/Function.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+commit 6169bfb1ecd289a8235be0b8884a550f5d1ad926
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 19:56:34 2018 +0200
+
+    GfxState.cc: Fix potential division by zero
+
+    fixes oss-fuzz/8465
+
+ poppler/GfxState.cc | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+commit 0868c499a9f5f37f8df5c9fef03c37496b40fc8a
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 19:42:38 2018 +0200
+
+    Parser::makeStream: Fix potential integer overflow
+
+ poppler/Parser.cc | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+commit dbe330678766d1260d7f595d238e90aeae1194d6
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 19:31:34 2018 +0200
+
+    XRef::constructXRef: Prevent overflow when calculating newSize
+
+    fixes oss-fuzz/8421
+
+ poppler/XRef.cc | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+commit 224dda4d292a097866f109a9d2cec4b3ba78eb97
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 19:17:20 2018 +0200
+
+    Fix out of bounds write in BaseCryptStream
+
+    fixes oss-fuzz/8420
+
+ poppler/Decrypt.cc | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+commit 0c0c368fed70c1db64ce04b135fd5b060a1f0653
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 18:26:29 2018 +0200
+
+    LZWStream::clearTable: init newChar to 0
+
+    it should not be needed because on well formed streams it will be
+    properly initialized in processNextCode but
+    this solves an uninitialized memory use on malformed documents
+
+    fixes oss-fuzz/8457
+
+ poppler/Stream.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit e7f59e39a0aca2a8a363fc0edcf25fb5aaada7a5
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 18:22:29 2018 +0200
+
+    Splash::scaleMaskYuXu: Fix crash on malformed files
+
+    fixes oss-fuzz/8435
+    fixes oss-fuzz/8441
+
+ splash/Splash.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 547f19cd420f2d579d921620545e6496adb6a9fb
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 18:17:58 2018 +0200
+
+    Fix crash in "generic" GlobalParams::findSystemFontFile
+
+    Not very important since we usually either use the fontconfig or
+    the windows one
+
+    fixes oss-fuzz/8427
+
+ poppler/GlobalParams.cc | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+commit d1d8dea64db53fb151fede27efd5fd3308820a51
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 18:13:19 2018 +0200
+
+    Fix memory leak on malformed files
+
+    fixes oss-fuzz/8430
+
+ poppler/Gfx.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit 127d0fe3a209b04fc9efb086d423bca4ba359dca
+Author: Albert Astals Cid <aacid@kde.org>
+Date:   Tue May 22 01:08:12 2018 +0200
+
+    Fix overflownLongLong check
+
+    We actually want integer math here since doubles lose the precision we
+    want at that high long long values
+
+ poppler/Lexer.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 commit c9e2dc7ea7e098875e6b93566bdb1d14451c3673
 Author: Albert Astals Cid <aacid@kde.org>
 Date:   Sat May 19 17:05:25 2018 +0200
diff --git a/Build/source/libs/poppler/poppler-src/NEWS b/Build/source/libs/poppler/poppler-src/NEWS
index 8e380f15799..328265617a5 100644
--- a/Build/source/libs/poppler/poppler-src/NEWS
+++ b/Build/source/libs/poppler/poppler-src/NEWS
@@ -1,3 +1,10 @@
+Release 0.66.0
+        core:
+         * Fix lots of security/leak issues found by oss-fuzz
+         * Splash: Optimize some files, making them 20% faster
+         * Splash: Correctly manipulate spot colors if SPOT_NCOMPS != 4
+         * Fix compilation with some strict compilers
+
 Release 0.65.0
         core:
          * SplashOutputDev: Add the invisible character check beginType3Char. Bug #106244
diff --git a/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc b/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc
index 3d41145b15d..ffe9c47c742 100644
--- a/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc
+++ b/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc
@@ -378,13 +378,12 @@ GBool StreamReader::getUVarBE(int pos, int size, Guint *val) {
 }
 
 GBool StreamReader::cmp(int pos, const char *s) {
-  int n;
-
-  n = (int)strlen(s);
+  const int n = (int)strlen(s);
   if (!fillBuf(pos, n)) {
     return gFalse;
   }
-  return !memcmp(buf - bufPos + pos, s, n);
+  const int posDiff = pos - bufPos;
+  return !memcmp(buf + posDiff, s, n);
 }
 
 GBool StreamReader::fillBuf(int pos, int len) {
diff --git a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc
index dbe95b67174..2806d92fbef 100644
--- a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc
+++ b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc
@@ -226,9 +226,13 @@ void FoFiType1::parse() {
        ++i) {
 
     // get font name
-    if (!name && !strncmp(line, "/FontName", 9)) {
-      strncpy(buf, line, 255);
-      buf[255] = '\0';
+    if (!name &&
+	(line + 9 <= (char*)file + len) &&
+	!strncmp(line, "/FontName", 9)) {
+      const auto availableFile = (char*)file + len - line;
+      const int lineLen = availableFile < 255 ? availableFile : 255;
+      strncpy(buf, line, lineLen);
+      buf[lineLen] = '\0';
       if ((p = strchr(buf+9, '/')) &&
 	  (p = strtok_r(p+1, " \t\n\r", &tokptr))) {
 	name = copyString(p);
@@ -237,9 +241,11 @@ void FoFiType1::parse() {
 
     // get encoding
     } else if (!encoding &&
+	       (line + 30 <= (char*)file + len) &&
 	       !strncmp(line, "/Encoding StandardEncoding def", 30)) {
       encoding = (char **)fofiType1StandardEncoding;
     } else if (!encoding &&
+	       (line + 19 <= (char*)file + len) &&
 	       !strncmp(line, "/Encoding 256 array", 19)) {
       encoding = (char **)gmallocn(256, sizeof(char *));
       for (j = 0; j < 256; ++j) {
@@ -331,9 +337,13 @@ void FoFiType1::parse() {
       }
       //~ check for getinterval/putinterval junk
 
-    } else if (!gotMatrix && !strncmp(line, "/FontMatrix", 11)) {
-      strncpy(buf, line + 11, 255);
-      buf[255] = '\0';
+    } else if (!gotMatrix &&
+	       (line + 11 <= (char*)file + len) &&
+	       !strncmp(line, "/FontMatrix", 11)) {
+      const auto availableFile = (char*)file + len - (line + 11);
+      const int bufLen = availableFile < 255 ? availableFile : 255;
+      strncpy(buf, line + 11, bufLen);
+      buf[bufLen] = '\0';
       if ((p = strchr(buf, '['))) {
 	++p;
 	if ((p2 = strchr(p, ']'))) {
diff --git a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc
index b14561ff31e..37694869d9c 100644
--- a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc
+++ b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc
@@ -2126,6 +2126,9 @@ void FoFiType1C::readTopDict() {
   topDict.fdSelectOffset = 0;
 
   getIndexVal(&topDictIdx, 0, &topDictPtr, &parsedOk);
+  if (!parsedOk) {
+      return;
+  }
   pos = topDictPtr.pos;
   nOps = 0;
   while (pos < topDictPtr.pos + topDictPtr.len) {
diff --git a/Build/source/libs/poppler/poppler-src/goo/gmem.cc b/Build/source/libs/poppler/poppler-src/goo/gmem.cc
index 574997fadda..f118fd715d4 100644
--- a/Build/source/libs/poppler/poppler-src/goo/gmem.cc
+++ b/Build/source/libs/poppler/poppler-src/goo/gmem.cc
@@ -178,17 +178,15 @@ void *grealloc_checkoverflow(void *p, size_t size) {
 }
 
 inline static void *gmallocn(int nObjs, int objSize, bool checkoverflow) {
-  int n;
-
   if (nObjs == 0) {
     return nullptr;
   }
-  n = nObjs * objSize;
   if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
     fprintf(stderr, "Bogus memory allocation size\n");
     if (checkoverflow) return nullptr;
     else exit(1);
   }
+  const int n = nObjs * objSize;
   return gmalloc(n, checkoverflow);
 }
 
@@ -219,15 +217,12 @@ void *gmallocn3_checkoverflow(int a, int b, int c) {
 }
 
 inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflow) {
-  int n;
-
   if (nObjs == 0) {
     if (p) {
       gfree(p);
     }
     return nullptr;
   }
-  n = nObjs * objSize;
   if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
     fprintf(stderr, "Bogus memory allocation size\n");
     if (checkoverflow) {
@@ -237,6 +232,7 @@ inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflo
       exit(1);
     }
   }
+  const int n = nObjs * objSize;
   return grealloc(p, n, checkoverflow);
 }
 
diff --git a/Build/source/libs/poppler/poppler-src/poppler/CMap.cc b/Build/source/libs/poppler/poppler-src/poppler/CMap.cc
index 01bff352a08..614009b77ac 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/CMap.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/CMap.cc
@@ -234,7 +234,7 @@ void CMap::parse2(CMapCache *cache, int (*getCharFunc)(void *), void *data) {
   PSTokenizer *pst;
   char tok1[256], tok2[256], tok3[256];
   int n1, n2, n3;
-  Guint start, end, code;
+  Guint start = 0, end = 0, code;
 
   pst = new PSTokenizer(getCharFunc, data);
   pst->getToken(tok1, sizeof(tok1), &n1);
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc b/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc
index bf858cecaf1..9577b655234 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc
@@ -311,22 +311,26 @@ BaseCryptStream::BaseCryptStream(Stream *strA, Guchar *fileKey, CryptAlgorithm a
 				 int keyLength, int objNum, int objGen):
   FilterStream(strA)
 {
-  int i;
-
   algo = algoA;
 
   // construct object key
-  for (i = 0; i < keyLength; ++i) {
+  for (int i = 0; i < keyLength; ++i) {
     objKey[i] = fileKey[i];
   }
+  for (std::size_t i = keyLength; i < sizeof(objKey); ++i) {
+    objKey[i] = 0;
+  }
+
   switch (algo) {
   case cryptRC4:
-    objKey[keyLength] = objNum & 0xff;
-    objKey[keyLength + 1] = (objNum >> 8) & 0xff;
-    objKey[keyLength + 2] = (objNum >> 16) & 0xff;
-    objKey[keyLength + 3] = objGen & 0xff;
-    objKey[keyLength + 4] = (objGen >> 8) & 0xff;
-    md5(objKey, keyLength + 5, objKey);
+    if (likely(keyLength < static_cast<int>(sizeof(objKey) - 4))) {
+      objKey[keyLength] = objNum & 0xff;
+      objKey[keyLength + 1] = (objNum >> 8) & 0xff;
+      objKey[keyLength + 2] = (objNum >> 16) & 0xff;
+      objKey[keyLength + 3] = objGen & 0xff;
+      objKey[keyLength + 4] = (objGen >> 8) & 0xff;
+      md5(objKey, keyLength + 5, objKey);
+    }
     if ((objKeyLength = keyLength + 5) > 16) {
       objKeyLength = 16;
     }
@@ -1148,7 +1152,7 @@ static inline Gulong md5Round4(Gulong a, Gulong b, Gulong c, Gulong d,
 }
 
 void md5(Guchar *msg, int msgLen, Guchar *digest) {
-  Gulong x[16];
+  Gulong x[16] = {};
   Gulong a, b, c, d, aa, bb, cc, dd;
   int n64;
   int i, j, k;
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Function.cc b/Build/source/libs/poppler/poppler-src/poppler/Function.cc
index 5437de35616..cc32414b87b 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Function.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Function.cc
@@ -13,7 +13,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2006, 2008-2010, 2013-2015, 2017 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006, 2008-2010, 2013-2015, 2017, 2018 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2006 Jeff Muizelaar <jeff@infidigm.net>
 // Copyright (C) 2010 Christian Feuersänger <cfeuersaenger@googlemail.com>
 // Copyright (C) 2011 Andrea Canciani <ranma42@gmail.com>
@@ -295,6 +295,10 @@ SampledFunction::SampledFunction(Object *funcObj, Dict *dict) {
     return;
   }
   sampleBits = obj1.getInt();
+  if (unlikely(sampleBits < 1 || sampleBits > 32)) {
+    error(errSyntaxError, -1, "Function invalid BitsPerSample");
+    return;
+  }
   sampleMul = 1.0 / (pow(2.0, (double)sampleBits) - 1);
 
   //----- Encode
@@ -321,6 +325,10 @@ SampledFunction::SampledFunction(Object *funcObj, Dict *dict) {
     }
   }
   for (i = 0; i < m; ++i) {
+    if (unlikely((domain[i][1] - domain[i][0]) == 0)) {
+      error(errSyntaxError, -1, "Illegal value in function domain array");
+      return;
+    }
     inputMul[i] = (encode[i][1] - encode[i][0]) /
                   (domain[i][1] - domain[i][0]);
   }
@@ -1295,6 +1303,7 @@ GBool PostScriptFunction::parseCode(Stream *str, int *codePtr) {
       if (!tok->cmp("{")) {
 	elsePtr = *codePtr;
 	if (!parseCode(str, codePtr)) {
+	  delete tok;
 	  return gFalse;
 	}
 	delete tok;
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc b/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc
index a4d12a70a35..572f435cd90 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc
@@ -947,11 +947,10 @@ void Gfx::opSetDash(Object args[], int numArgs) {
     dash = nullptr;
   } else {
     dash = (double *)gmallocn(length, sizeof(double));
+    bool dummyOk;
     for (i = 0; i < length; ++i) {
-      Object obj = a->get(i);
-      if (obj.isNum()) {
-	dash[i] = obj.getNum();
-      }
+      const Object obj = a->get(i);
+      dash[i] = obj.getNum(&dummyOk);
     }
   }
   state->setLineDash(dash, length, args[1].getNum());
@@ -990,7 +989,6 @@ void Gfx::opSetExtGState(Object args[], int numArgs) {
   Function *funcs[4];
   GfxColor backdropColor;
   GBool haveBackdropColor;
-  GfxColorSpace *blendingColorSpace;
   GBool alpha, isolated, knockout;
   double opac;
   int i;
@@ -1197,7 +1195,7 @@ void Gfx::opSetExtGState(Object args[], int numArgs) {
       if (obj3.isStream()) {
 	Object obj4 = obj3.streamGetDict()->lookup("Group");
 	if (obj4.isDict()) {
-	  blendingColorSpace = nullptr;
+	  GfxColorSpace *blendingColorSpace = nullptr;
 	  isolated = knockout = gFalse;
 	  Object obj5 = obj4.dictLookup("CS");
 	  if (!obj5.isNull()) {
@@ -1223,15 +1221,14 @@ void Gfx::opSetExtGState(Object args[], int numArgs) {
 	  }
 	  doSoftMask(&obj3, alpha, blendingColorSpace,
 		     isolated, knockout, funcs[0], &backdropColor);
-	  if (funcs[0]) {
-	    delete funcs[0];
-	  }
+	  delete blendingColorSpace;
 	} else {
 	  error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group");
 	}
       } else {
 	error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group");
       }
+      delete funcs[0];
     } else if (!obj2.isNull()) {
       error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState");
     }
@@ -1357,10 +1354,6 @@ void Gfx::doSoftMask(Object *str, GBool alpha,
 	  blendingColorSpace, isolated, knockout,
 	  alpha, transferFunc, backdropColor);
   --formDepth;
-
-  if (blendingColorSpace) {
-    delete blendingColorSpace;
-  }
 }
 
 void Gfx::opSetRenderingIntent(Object args[], int numArgs) {
@@ -2610,7 +2603,7 @@ void Gfx::doAxialShFill(GfxAxialShading *shading) {
   double t0, t1, tt;
   double ta[axialMaxSplits + 1];
   int next[axialMaxSplits + 1];
-  GfxColor color0, color1;
+  GfxColor color0 = {}, color1 = {};
   int nComps;
   int i, j, k;
   GBool needExtend = gTrue;
@@ -2910,7 +2903,7 @@ void Gfx::doRadialShFill(GfxRadialShading *shading) {
   double xMin, yMin, xMax, yMax;
   double x0, y0, r0, x1, y1, r1, t0, t1;
   int nComps;
-  GfxColor colorA, colorB;
+  GfxColor colorA = {}, colorB = {}, colorC = {};
   double xa, ya, xb, yb, ra, rb;
   double ta, tb, sa, sb;
   double sz, xz, yz, sMin, sMax;
@@ -2941,7 +2934,12 @@ void Gfx::doRadialShFill(GfxRadialShading *shading) {
     xz = x0 + sz * (x1 - x0);
     yz = y0 + sz * (y1 - y0);
     enclosed = (xz - x0) * (xz - x0) + (yz - y0) * (yz - y0) <= r0 * r0;
-    theta = asin(r0 / sqrt((x0 - xz) * (x0 - xz) + (y0 - yz) * (y0 - yz)));
+    const double theta_aux = sqrt((x0 - xz) * (x0 - xz) + (y0 - yz) * (y0 - yz));
+    if (likely(theta_aux != 0)) {
+      theta = asin(r0 / theta_aux);
+    } else {
+      theta = 0;
+    }
     if (r0 > r1) {
       theta = -theta;
     }
@@ -3081,7 +3079,6 @@ void Gfx::doRadialShFill(GfxRadialShading *shading) {
         // same color does not mean all the areas in between have the same color too
         int ic = ia + 1;
         for (; ic <= ib; ic++) {
-          GfxColor colorC;
           const double sc = sMin + ((double)ic / (double)radialMaxSplits) * (sMax - sMin);
           const double tc = t0 + sc * (t1 - t0);
           getShadingColorRadialHelper(t0, t1, tc, shading, &colorC);
@@ -4457,6 +4454,7 @@ void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) {
       }
       maskColorSpace = GfxColorSpace::parse(nullptr, &obj1, out, state);
       if (!maskColorSpace || maskColorSpace->getMode() != csDeviceGray) {
+	delete maskColorSpace;
 	goto err1;
       }
       obj1 = maskDict->lookup("Decode");
diff --git a/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc b/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc
index 5d7cc6baa24..157bcf44181 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc
@@ -72,9 +72,13 @@
 
 GBool Matrix::invertTo(Matrix *other) const
 {
-  double det;
+  const double det_denominator = determinant();
+  if (unlikely(det_denominator == 0)) {
+      *other = {1, 0, 0, 1, 0, 0};
+      return gFalse;
+  }
 
-  det = 1 / determinant();
+  const double det = 1 / det_denominator;
   other->m[0] = m[3] * det;
   other->m[1] = -m[1] * det;
   other->m[2] = -m[2] * det;
@@ -2812,9 +2816,15 @@ void GfxSeparationColorSpace::getRGB(GfxColor *color, GfxRGB *rgb) {
   } else {
     x = colToDbl(color->c[0]);
     func->transform(&x, c);
-    for (i = 0; i < alt->getNComps(); ++i) {
+    const int altNComps = alt->getNComps();
+    for (i = 0; i < altNComps; ++i) {
       color2.c[i] = dblToCol(c[i]);
     }
+    if (unlikely(altNComps > func->getOutputSize())) {
+      for (i = func->getOutputSize(); i < altNComps; ++i) {
+	color2.c[i] = 0;
+      }
+    }
     alt->getRGB(&color2, rgb);
   }
 }
@@ -3887,7 +3897,7 @@ GfxUnivariateShading::~GfxUnivariateShading() {
   gfree (cacheBounds);
 }
 
-void GfxUnivariateShading::getColor(double t, GfxColor *color) {
+int GfxUnivariateShading::getColor(double t, GfxColor *color) {
   double out[gfxColorMaxComps];
 
   // NB: there can be one function with n outputs or n functions with
@@ -3897,7 +3907,7 @@ void GfxUnivariateShading::getColor(double t, GfxColor *color) {
   if (unlikely(nFuncs < 1 || nComps > gfxColorMaxComps)) {
     for (int i = 0; i < gfxColorMaxComps; i++)
         color->c[i] = 0;
-    return;
+    return gfxColorMaxComps;
   }
 
   if (cacheSize > 0) {
@@ -3937,6 +3947,7 @@ void GfxUnivariateShading::getColor(double t, GfxColor *color) {
   for (int i = 0; i < nComps; ++i) {
     color->c[i] = dblToCol(out[i]);
   }
+  return nComps;
 }
 
 void GfxUnivariateShading::setupCache(const Matrix *ctm,
@@ -4059,7 +4070,6 @@ GfxAxialShading *GfxAxialShading::parse(GfxResources *res, Dict *dict, OutputDev
   int nFuncsA;
   GBool extend0A, extend1A;
   Object obj1;
-  int i;
 
   x0A = y0A = x1A = y1A = 0;
   obj1 = dict->lookup("Coords");
@@ -4098,9 +4108,11 @@ GfxAxialShading *GfxAxialShading::parse(GfxResources *res, Dict *dict, OutputDev
       error(errSyntaxWarning, -1, "Invalid Function array in shading dictionary");
       return nullptr;
     }
-    for (i = 0; i < nFuncsA; ++i) {
+    for (int i = 0; i < nFuncsA; ++i) {
       Object obj2 = obj1.arrayGet(i);
       if (!(funcsA[i] = Function::parse(&obj2))) {
+	for (int j = 0; j < i; ++j)
+	  delete funcsA[j];
 	return nullptr;
       }
     }
@@ -4172,7 +4184,13 @@ void GfxAxialShading::getParameterRange(double *lower, double *upper,
 
   pdx = x1 - x0;
   pdy = y1 - y0;
-  invsqnorm = 1.0 / (pdx * pdx + pdy * pdy);
+  const double invsqnorm_denominator = (pdx * pdx + pdy * pdy);
+  if (unlikely(invsqnorm_denominator == 0)) {
+    *lower = 0;
+    *upper = 0;
+    return;
+  }
+  invsqnorm = 1.0 / invsqnorm_denominator;
   pdx *= invsqnorm;
   pdy *= invsqnorm;
 
@@ -4771,6 +4789,10 @@ GfxGouraudTriangleShading *GfxGouraudTriangleShading::parse(GfxResources *res, i
     error(errSyntaxWarning, -1, "Missing or invalid BitsPerCoordinate in shading dictionary");
     return nullptr;
   }
+  if (unlikely(coordBits <= 0)) {
+    error(errSyntaxWarning, -1, "Invalid BitsPerCoordinate in shading dictionary");
+    return nullptr;
+  }
   obj1 = dict->lookup("BitsPerComponent");
   if (obj1.isInt()) {
     compBits = obj1.getInt();
@@ -4778,6 +4800,10 @@ GfxGouraudTriangleShading *GfxGouraudTriangleShading::parse(GfxResources *res, i
     error(errSyntaxWarning, -1, "Missing or invalid BitsPerComponent in shading dictionary");
     return nullptr;
   }
+  if (unlikely(compBits <= 0 || compBits > 31)) {
+    error(errSyntaxWarning, -1, "Invalid BitsPerComponent in shading dictionary");
+    return nullptr;
+  }
   flagBits = vertsPerRow = 0; // make gcc happy
   if (typeA == 4) {
     obj1 = dict->lookup("BitsPerFlag");
@@ -4809,7 +4835,7 @@ GfxGouraudTriangleShading *GfxGouraudTriangleShading::parse(GfxResources *res, i
     for (i = 0; 5 + 2*i < obj1.arrayGetLength() && i < gfxColorMaxComps; ++i) {
       cMin[i] = (obj2 = obj1.arrayGet(4 + 2*i), obj2.getNum(&decodeOk));
       cMax[i] = (obj2 = obj1.arrayGet(5 + 2*i), obj2.getNum(&decodeOk));
-      cMul[i] = (cMax[i] - cMin[i]) / (double)((1 << compBits) - 1);
+      cMul[i] = (cMax[i] - cMin[i]) / (double)((1u << compBits) - 1);
     }
     nComps = i;
 
@@ -5119,6 +5145,10 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
     error(errSyntaxWarning, -1, "Missing or invalid BitsPerCoordinate in shading dictionary");
     return nullptr;
   }
+  if (unlikely(coordBits <= 0)) {
+    error(errSyntaxWarning, -1, "Invalid BitsPerCoordinate in shading dictionary");
+    return nullptr;
+  }
   obj1 = dict->lookup("BitsPerComponent");
   if (obj1.isInt()) {
     compBits = obj1.getInt();
@@ -5126,6 +5156,10 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
     error(errSyntaxWarning, -1, "Missing or invalid BitsPerComponent in shading dictionary");
     return nullptr;
   }
+  if (unlikely(compBits <= 0 || compBits > 31)) {
+    error(errSyntaxWarning, -1, "Invalid BitsPerComponent in shading dictionary");
+    return nullptr;
+  }
   obj1 = dict->lookup("BitsPerFlag");
   if (obj1.isInt()) {
     flagBits = obj1.getInt();
@@ -5146,7 +5180,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
     for (i = 0; 5 + 2*i < obj1.arrayGetLength() && i < gfxColorMaxComps; ++i) {
       cMin[i] = (obj2 = obj1.arrayGet(4 + 2*i), obj2.getNum(&decodeOk));
       cMax[i] = (obj2 = obj1.arrayGet(5 + 2*i), obj2.getNum(&decodeOk));
-      cMul[i] = (cMax[i] - cMin[i]) / (double)((1 << compBits) - 1);
+      cMul[i] = (cMax[i] - cMin[i]) / (double)((1u << compBits) - 1);
     }
     nComps = i;
 
@@ -5283,6 +5317,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
       case 1:
 	if (nPatchesA == 0) {
           gfree(patchesA);
+	  for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
 	  return nullptr;
 	}
 	p->x[0][0] = patchesA[nPatchesA-1].x[0][3];
@@ -5319,6 +5354,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
       case 2:
 	if (nPatchesA == 0) {
           gfree(patchesA);
+	  for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
 	  return nullptr;
 	}
 	p->x[0][0] = patchesA[nPatchesA-1].x[3][3];
@@ -5355,6 +5391,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
       case 3:
 	if (nPatchesA == 0) {
           gfree(patchesA);
+	  for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
 	  return nullptr;
 	}
 	p->x[0][0] = patchesA[nPatchesA-1].x[3][0];
@@ -5434,6 +5471,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
       case 1:
 	if (nPatchesA == 0) {
           gfree(patchesA);
+	  for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
 	  return nullptr;
 	}
 	p->x[0][0] = patchesA[nPatchesA-1].x[0][3];
@@ -5478,6 +5516,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
       case 2:
 	if (nPatchesA == 0) {
           gfree(patchesA);
+	  for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
 	  return nullptr;
 	}
 	p->x[0][0] = patchesA[nPatchesA-1].x[3][3];
@@ -5522,6 +5561,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
       case 3:
 	if (nPatchesA == 0) {
           gfree(patchesA);
+	  for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
 	  return nullptr;
 	}
 	p->x[0][0] = patchesA[nPatchesA-1].x[3][0];
@@ -5651,7 +5691,7 @@ GfxImageColorMap::GfxImageColorMap(int bitsA, Object *decode,
   Guchar *indexedLookup;
   Function *sepFunc;
   double x[gfxColorMaxComps];
-  double y[gfxColorMaxComps];
+  double y[gfxColorMaxComps] = {};
   int i, j, k;
   double mapped;
   GBool useByteLookup;
@@ -5677,6 +5717,9 @@ GfxImageColorMap::GfxImageColorMap(int bitsA, Object *decode,
   }
   byte_lookup = nullptr;
 
+  if (unlikely(bits <= 0))
+    goto err1;
+
   // get decode map
   if (decode->isNull()) {
     nComps = colorSpace->getNComps();
@@ -6745,10 +6788,18 @@ void GfxState::setPath(GfxPath *pathA) {
 void GfxState::getUserClipBBox(double *xMin, double *yMin,
 			       double *xMax, double *yMax) {
   double ictm[6];
-  double xMin1, yMin1, xMax1, yMax1, det, tx, ty;
+  double xMin1, yMin1, xMax1, yMax1, tx, ty;
 
   // invert the CTM
-  det = 1 / (ctm[0] * ctm[3] - ctm[1] * ctm[2]);
+  const double det_denominator = (ctm[0] * ctm[3] - ctm[1] * ctm[2]);
+  if (unlikely(det_denominator == 0)) {
+      *xMin = 0;
+      *yMin = 0;
+      *xMax = 0;
+      *yMax = 0;
+      return;
+  }
+  const double det = 1 / det_denominator;
   ictm[0] = ctm[3] * det;
   ictm[1] = -ctm[1] * det;
   ictm[2] = -ctm[2] * det;
diff --git a/Build/source/libs/poppler/poppler-src/poppler/GfxState.h b/Build/source/libs/poppler/poppler-src/poppler/GfxState.h
index 6f4ae9a7c90..cd109045472 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/GfxState.h
+++ b/Build/source/libs/poppler/poppler-src/poppler/GfxState.h
@@ -915,7 +915,9 @@ public:
   GBool getExtend1() { return extend1; }
   int getNFuncs() { return nFuncs; }
   Function *getFunc(int i) { return funcs[i]; }
-  void getColor(double t, GfxColor *color);
+  // returns the nComps of the shading
+  // i.e. how many positions of color have been set
+  int getColor(double t, GfxColor *color);
 
   void setupCache(const Matrix *ctm,
 		  double xMin, double yMin,
diff --git a/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc b/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc
index 2d8ecad74c3..6d8941ea3bc 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc
@@ -1296,9 +1296,12 @@ GooString *GlobalParams::findSystemFontFile(GfxFont *font,
   SysFontInfo *fi;
   GooString *path;
 
+  const GooString *fontName = font->getName();
+  if (!fontName) return nullptr;
+
   path = NULL;
   lockGlobalParams;
-  if ((fi = sysFonts->find(font->getName(), font->isFixedWidth(), gFalse))) {
+  if ((fi = sysFonts->find(fontName, font->isFixedWidth(), gFalse))) {
     path = fi->path->copy();
     *type = fi->type;
     *fontNum = fi->fontNum;
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Hints.cc b/Build/source/libs/poppler/poppler-src/poppler/Hints.cc
index 2f5fec6ccdd..ecee04681c6 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Hints.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Hints.cc
@@ -5,7 +5,7 @@
 // This file is licensed under the GPLv2 or later
 //
 // Copyright 2010, 2012 Hib Eris <hib@hiberis.nl>
-// Copyright 2010, 2011, 2013, 2014, 2016, 2017 Albert Astals Cid <aacid@kde.org>
+// Copyright 2010, 2011, 2013, 2014, 2016-2018 Albert Astals Cid <aacid@kde.org>
 // Copyright 2010, 2013 Pino Toscano <pino@kde.org>
 // Copyright 2013 Adrian Johnson <ajohnson@redneon.com>
 // Copyright 2014 Fabio D'Urso <fabiodurso@hotmail.it>
@@ -258,6 +258,11 @@ GBool Hints::readPageOffsetTable(Stream *str)
   if (objectOffsetFirst >= hintsOffset) objectOffsetFirst += hintsLength;
 
   nBitsDiffObjects = sbr.readBits(16);
+  if (nBitsDiffObjects > 32) {
+    error(errSyntaxWarning, -1, "Invalid number of bits needed to represent the difference between the greatest and least number of objects in a page");
+    nPages = 0;
+    return gFalse;
+  }
 
   pageLengthLeast = sbr.readBits(32);
 
diff --git a/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc b/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc
index ac7e7382c73..2ed787e0510 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc
@@ -1562,7 +1562,7 @@ GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint length,
   JBIG2Bitmap *collBitmap, *refBitmap;
   Guint *symWidths;
   Guint symHeight, symWidth, totalWidth, x, symID;
-  int dh, dw, refAggNum, refDX, refDY, bmSize;
+  int dh = 0, dw, refAggNum, refDX = 0, refDY = 0, bmSize;
   GBool ex;
   int run, cnt, c;
   Guint i, j, k;
@@ -1896,6 +1896,7 @@ GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint length,
 	}
 	for (k = 0; k < (Guint)bmSize; ++k) {
 	  if ((c = curStr->getChar()) == EOF) {
+	    memset(p, 0, bmSize - k);
 	    break;
 	  }
 	  *p++ = (Guchar)c;
@@ -1930,6 +1931,8 @@ GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint length,
   // exported symbol list
   i = j = 0;
   ex = gFalse;
+  run = 0; // initialize it once in case the first decodeInt fails
+           // we do not want to use uninitialized memory
   while (i < numInputSyms + numNewSyms) {
     if (huff) {
       huffDecoder->decodeInt(&run, huffTableA);
@@ -2335,8 +2338,8 @@ JBIG2Bitmap *JBIG2Stream::readTextRegion(GBool huff, GBool refine,
   JBIG2Bitmap *bitmap;
   JBIG2Bitmap *symbolBitmap;
   Guint strips;
-  int t, dt, tt, s, ds, sFirst, j;
-  int rdw, rdh, rdx, rdy, ri, refDX, refDY, bmSize;
+  int t = 0, dt = 0, tt, s, ds = 0, sFirst, j;
+  int rdw, rdh, rdx, rdy, ri = 0, refDX, refDY, bmSize;
   Guint symID, inst, bw, bh;
 
   strips = 1 << logStrips;
@@ -4023,6 +4026,7 @@ void JBIG2Stream::readPageInfoSeg(Guint length) {
   } else {
     curPageH = pageH;
   }
+  delete pageBitmap;
   pageBitmap = new JBIG2Bitmap(0, pageW, curPageH);
 
   if (!pageBitmap->isOk()) {
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc b/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc
index a5090838e07..9ae19c34ae7 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc
@@ -206,7 +206,7 @@ Object Lexer::getObj(int objNum) {
 	  xf = xf * 10.0 + (c - '0');
 	} else if (unlikely (overflownInteger)) {
 	  if (unlikely(xll > LongLongSafeLimit) &&
-	      (xll > (LLONG_MAX - (c - '0')) / 10.0)) {
+	      (xll > (LLONG_MAX - (c - '0')) / 10)) {
 	    overflownLongLong = gTrue;
 	    xf = xll * 10.0 + (c - '0');
 	  } else {
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Parser.cc b/Build/source/libs/poppler/poppler-src/poppler/Parser.cc
index 869e94ad0c8..39c9a96720b 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Parser.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Parser.cc
@@ -13,7 +13,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2006, 2009, 201, 2010, 2013, 2014, 2017 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006, 2009, 201, 2010, 2013, 2014, 2017, 2018 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2006 Krzysztof Kowalczyk <kkowalczyk@gmail.com>
 // Copyright (C) 2009 Ilya Gorenbein <igorenbein@finjan.com>
 // Copyright (C) 2012 Hib Eris <hib@hiberis.nl>
@@ -235,6 +235,12 @@ Stream *Parser::makeStream(Object &&dict, Guchar *fileKey,
       pos = pos - 1;
       lexer->lookCharLastValueCached = Lexer::LOOK_VALUE_NOT_CACHED;
   }
+  if (unlikely(length < 0)) {
+      return nullptr;
+  }
+  if (unlikely(pos > LLONG_MAX - length)) {
+      return nullptr;
+  }
   lexer->setPos(pos + length);
 
   // refill token buffers and check for 'endstream'
@@ -255,7 +261,8 @@ Stream *Parser::makeStream(Object &&dict, Guchar *fileKey,
       // When building the xref we can't use it so use this
       // kludge for broken PDF files: just add 5k to the length, and
       // hope its enough
-      length += 5000;
+      if (length < LLONG_MAX - 5000)
+        length += 5000;
     }
   }
 
diff --git a/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc b/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc
index a643f45fa3a..bdfd89f8650 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc
@@ -315,6 +315,9 @@ StandardSecurityHandler::~StandardSecurityHandler() {
 }
 
 GBool StandardSecurityHandler::isUnencrypted() {
+  if (!ok) {
+    return gTrue;
+  }
   return encVersion == -1 && encRevision == -1;
 }
 
diff --git a/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc b/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc
index a19e8c66e38..74953839a30 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc
@@ -39,6 +39,7 @@
 // Copyright (C) 2016 Takahiro Hashimoto <kenya888.en@gmail.com>
 // Copyright (C) 2017 Even Rouault <even.rouault@spatialys.com>
 // Copyright (C) 2018 Klarälvdalens Datakonsult AB, a KDAB Group company, <info@kdab.com>. Work sponsored by the LiMux project of the city of Munich
+// Copyright (C) 2018 Stefan Brüns <stefan.bruens@rwth-aachen.de>
 //
 // To see a description of the changes please see the Changelog file that
 // came with your tarball or type make ChangeLog if you are building from git
@@ -315,7 +316,11 @@ GBool SplashUnivariatePattern::getColor(int x, int y, SplashColorPtr c) {
   if (! getParameter (xc, yc, &t))
       return gFalse;
 
-  shading->getColor(t, &gfxColor);
+  const int filled = shading->getColor(t, &gfxColor);
+  if (unlikely(filled < shading->getColorSpace()->getNComps())) {
+    for (int i = filled; i < shading->getColorSpace()->getNComps(); ++i)
+      gfxColor.c[i] = 0;
+  }
   convertGfxColor(c, colorMode, shading->getColorSpace(), &gfxColor);
   return gTrue;
 }
@@ -453,7 +458,12 @@ SplashAxialPattern::SplashAxialPattern(SplashColorMode colorModeA, GfxState *sta
   shadingA->getCoords(&x0, &y0, &x1, &y1);
   dx = x1 - x0;
   dy = y1 - y0;
-  mul = 1 / (dx * dx + dy * dy);
+  const double mul_denominator = (dx * dx + dy * dy);
+  if (unlikely(mul_denominator == 0)) {
+    mul = 0;
+  } else {
+    mul = 1 / mul_denominator;
+  }
   shadingA->getColorSpace()->getDefaultColor(&srcColor);
   convertGfxColor(defaultColor, colorModeA, shadingA->getColorSpace(), &srcColor);
 }
@@ -1251,7 +1261,6 @@ T3FontCache::T3FontCache(const Ref *fontIDA, double m11A, double m12A,
 			 double m21A, double m22A,
 			 int glyphXA, int glyphYA, int glyphWA, int glyphHA,
 			 GBool validBBoxA, GBool aa) {
-  int i;
 
   fontID = *fontIDA;
   m11 = m11A;
@@ -1265,8 +1274,7 @@ T3FontCache::T3FontCache(const Ref *fontIDA, double m11A, double m12A,
   validBBox = validBBoxA;
   // sanity check for excessively large glyphs (which most likely
   // indicate an incorrect BBox)
-  i = glyphW * glyphH;
-  if (i > 100000 || glyphW > INT_MAX / glyphH || glyphW <= 0 || glyphH <= 0) {
+  if (glyphW > INT_MAX / glyphH || glyphW <= 0 || glyphH <= 0 || glyphW * glyphH > 100000) {
     glyphW = glyphH = 100;
     validBBox = gFalse;
   }
@@ -1293,7 +1301,7 @@ T3FontCache::T3FontCache(const Ref *fontIDA, double m11A, double m12A,
   {
     cacheTags = (T3FontCacheTag *)gmallocn(cacheSets * cacheAssoc,
 					 sizeof(T3FontCacheTag));
-    for (i = 0; i < cacheSets * cacheAssoc; ++i) {
+    for (int i = 0; i < cacheSets * cacheAssoc; ++i) {
       cacheTags[i].mru = i & (cacheAssoc - 1);
     }
   }
@@ -1445,6 +1453,7 @@ SplashOutputDev::~SplashOutputDev() {
   if (bitmap) {
     delete bitmap;
   }
+  delete textClipPath;
 }
 
 void SplashOutputDev::startDoc(PDFDoc *docA) {
@@ -2360,6 +2369,7 @@ SplashPath *SplashOutputDev::convertPath(GfxState *state, GfxPath *path,
   for (i = 0; i < path->getNumSubpaths(); ++i) {
     subpath = path->getSubpath(i);
     if (subpath->getNumPoints() > n) {
+      sPath->reserve(subpath->getNumPoints() + 1);
       sPath->moveTo((SplashCoord)subpath->getX(0),
 		    (SplashCoord)subpath->getY(0));
       j = 1;
@@ -3982,11 +3992,15 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref,
   //----- set up the soft mask
 
   if (maskColorMap->getMatteColor() != nullptr) {
-    Guchar *data = (Guchar *) gmalloc(maskWidth * maskHeight);
+    const int maskChars = maskWidth * maskHeight;
+    Guchar *data = (Guchar *) gmalloc(maskChars);
     maskStr->reset();
-    maskStr->doGetChars(maskWidth * maskHeight, data);
+    const int readChars = maskStr->doGetChars(maskChars, data);
+    if (unlikely(readChars < maskChars)) {
+      memset(&data[readChars], 0, maskChars - readChars);
+    }
     maskStr->close();
-    maskStr = new AutoFreeMemStream((char *)data, 0, maskWidth * maskHeight, maskStr->getDictObject()->copy());
+    maskStr = new AutoFreeMemStream((char *)data, 0, maskChars, maskStr->getDictObject()->copy());
   }
   imgMaskData.imgStr = new ImageStream(maskStr, maskWidth,
 				       maskColorMap->getNumPixelComps(),
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Stream.cc b/Build/source/libs/poppler/poppler-src/poppler/Stream.cc
index 15a6a9f9aa1..21bd3b9bdde 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Stream.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/Stream.cc
@@ -28,7 +28,7 @@
 // Copyright (C) 2012 Fabio D'Urso <fabiodurso@hotmail.it>
 // Copyright (C) 2012 Even Rouault <even.rouault@mines-paris.org>
 // Copyright (C) 2013, 2017, 2018 Adrian Johnson <ajohnson@redneon.com>
-// Copyright (C) 2013 Adam Reichold <adamreichold@myopera.com>
+// Copyright (C) 2013, 2018 Adam Reichold <adamreichold@myopera.com>
 // Copyright (C) 2013 Pino Toscano <pino@kde.org>
 // Copyright (C) 2015 Suzuki Toshiya <mpsuzuki@hiroshima-u.ac.jp>
 // Copyright (C) 2015 Jason Crain <jason@aquaticape.us>
@@ -572,8 +572,6 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
   ok = gFalse;
 
   nVals = width * nComps;
-  pixBytes = (nComps * nBits + 7) >> 3;
-  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
   if (width <= 0 || nComps <= 0 || nBits <= 0 ||
       nComps > gfxColorMaxComps ||
       nBits > 16 ||
@@ -581,6 +579,8 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
       nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
     return;
   }
+  pixBytes = (nComps * nBits + 7) >> 3;
+  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
   predLine = (Guchar *)gmalloc(rowBytes);
   memset(predLine, 0, rowBytes);
   predIdx = rowBytes;
@@ -1435,6 +1435,7 @@ void LZWStream::clearTable() {
   nextBits = 9;
   seqIndex = seqLength = 0;
   first = gTrue;
+  newChar = 0;
 }
 
 int LZWStream::getCode() {
@@ -1444,10 +1445,10 @@ int LZWStream::getCode() {
   while (inputBits < nextBits) {
     if ((c = str->getChar()) == EOF)
       return EOF;
-    inputBuf = (inputBuf << 8) | (c & 0xff);
+    inputBuf = (inputBuf << 8) | static_cast<unsigned>(c & 0xff);
     inputBits += 8;
   }
-  code = (inputBuf >> (inputBits - nextBits)) & ((1 << nextBits) - 1);
+  code = static_cast<signed>((inputBuf >> (inputBits - nextBits)) & ((1 << nextBits) - 1));
   inputBits -= nextBits;
   return code;
 }
diff --git a/Build/source/libs/poppler/poppler-src/poppler/Stream.h b/Build/source/libs/poppler/poppler-src/poppler/Stream.h
index a3faccd9b75..841c87a8c33 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/Stream.h
+++ b/Build/source/libs/poppler/poppler-src/poppler/Stream.h
@@ -24,7 +24,7 @@
 // Copyright (C) 2012, 2013 Fabio D'Urso <fabiodurso@hotmail.it>
 // Copyright (C) 2013, 2017 Adrian Johnson <ajohnson@redneon.com>
 // Copyright (C) 2013 Peter Breitenlohner <peb@mppmu.mpg.de>
-// Copyright (C) 2013 Adam Reichold <adamreichold@myopera.com>
+// Copyright (C) 2013, 2018 Adam Reichold <adamreichold@myopera.com>
 // Copyright (C) 2013 Pino Toscano <pino@kde.org>
 //
 // To see a description of the changes please see the Changelog file that
@@ -823,7 +823,7 @@ private:
   StreamPredictor *pred;	// predictor
   int early;			// early parameter
   GBool eof;			// true if at eof
-  int inputBuf;			// input buffer
+  unsigned int inputBuf;	// input buffer
   int inputBits;		// number of bits in input buffer
   struct {			// decoding table
     int length;
diff --git a/Build/source/libs/poppler/poppler-src/poppler/XRef.cc b/Build/source/libs/poppler/poppler-src/poppler/XRef.cc
index 25bc18a4452..95e1a1d45b5 100644
--- a/Build/source/libs/poppler/poppler-src/poppler/XRef.cc
+++ b/Build/source/libs/poppler/poppler-src/poppler/XRef.cc
@@ -574,7 +574,7 @@ GBool XRef::readXRefTable(Parser *parser, Goffset *pos, std::vector<Goffset> *fo
       goto err0;
     }
     n = obj.getInt();
-    if (first < 0 || n < 0 || first + n < 0) {
+    if (first < 0 || n < 0 || first > INT_MAX - n) {
       goto err0;
     }
     if (first + n > size) {
@@ -789,6 +789,9 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
   unsigned long long offset, gen;
   int type, c, i, j;
 
+  if (first > INT_MAX - n) {
+    return gFalse;
+  }
   if (first + n < 0) {
     return gFalse;
   }
@@ -866,7 +869,6 @@ GBool XRef::constructXRef(GBool *wasReconstructed, GBool needCatalogDict) {
   char buf[256];
   Goffset pos;
   int num, gen;
-  int newSize;
   int streamEndsSize;
   char *p;
   GBool gotRoot;
@@ -961,7 +963,11 @@ GBool XRef::constructXRef(GBool *wasReconstructed, GBool needCatalogDict) {
 	      while (*p && isspace(*p & 0xff)) ++p;
 	      if (!strncmp(p, "obj", 3)) {
 		if (num >= size) {
-		  newSize = (num + 1 + 255) & ~255;
+		  if (unlikely(num >= INT_MAX - 1 - 255)) {
+		    error(errSyntaxError, -1, "Bad object number");
+		    return gFalse;
+		  }
+		  const int newSize = (num + 1 + 255) & ~255;
 		  if (newSize < 0) {
 		    error(errSyntaxError, -1, "Bad object number");
 		    return gFalse;
@@ -1135,7 +1141,7 @@ Object XRef::fetch(int num, int gen, int recursion) {
 
   case xrefEntryUncompressed:
   {
-    if (e->gen != gen) {
+    if (e->gen != gen || e->offset < 0) {
       goto err;
     }
     parser = new Parser(this,
diff --git a/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h b/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h
index ca0e3bc0916..1bede11cd5e 100644
--- a/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h
+++ b/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h
@@ -17,6 +17,7 @@
 // Copyright (C) 2009 Stefan Thomas <thomas@eload24.com>
 // Copyright (C) 2010 William Bader <williambader@hotmail.com>
 // Copyright (C) 2017 Adrian Johnson <ajohnson@redneon.com>
+// Copyright (C) 2018 Stefan Brüns <stefan.bruens@rwth-aachen.de>
 //
 // To see a description of the changes please see the Changelog file that
 // came with your tarball or type make ChangeLog if you are building from git
@@ -126,7 +127,7 @@ static inline void splashClearColor(SplashColorPtr dest) {
   dest[2] = 0;
 #ifdef SPLASH_CMYK
   dest[3] = 0;
-  for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++)
+  for (int i = 4; i < SPOT_NCOMPS + 4; i++)
     dest[i] = 0;
 #endif
 }
@@ -137,7 +138,7 @@ static inline void splashColorCopy(SplashColorPtr dest, SplashColorPtr src) {
   dest[2] = src[2];
 #ifdef SPLASH_CMYK
   dest[3] = src[3];
-  for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++)
+  for (int i = 4; i < SPOT_NCOMPS + 4; i++)
     dest[i] = src[i];
 #endif
 }
@@ -148,7 +149,7 @@ static inline void splashColorXor(SplashColorPtr dest, SplashColorPtr src) {
   dest[2] ^= src[2];
 #ifdef SPLASH_CMYK
   dest[3] ^= src[3];
-  for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++)
+  for (int i = 4; i < SPOT_NCOMPS + 4; i++)
     dest[i] ^= src[i];
 #endif
 }
diff --git a/Build/source/libs/poppler/version.ac b/Build/source/libs/poppler/version.ac
index 16b8835644d..195b90c5486 100644
--- a/Build/source/libs/poppler/version.ac
+++ b/Build/source/libs/poppler/version.ac
@@ -9,4 +9,4 @@ dnl
 dnl --------------------------------------------------------
 dnl
 dnl  m4-include this file to define the current poppler version
-m4_define([poppler_version], [0.65.0])
+m4_define([poppler_version], [0.66.0])