summaryrefslogtreecommitdiff
path: root/Build/source/libs/xpdf/xpdf-3.02
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-3.02')
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc13
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc35
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h2
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc2
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc4
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc21
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h13
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h2
8 files changed, 70 insertions, 22 deletions
diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
index 537ee1a7901..e14821711b2 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
@@ -12,6 +12,7 @@
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include "gmem.h"
#include "SplashErrorCodes.h"
#include "SplashMath.h"
@@ -1912,7 +1913,10 @@ SplashError Splash::fillImageMask(SplashImageMaskSource src, void *srcData,
xq = w % scaledWidth;
// allocate pixel buffer
- pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);
+ if (yp < 0 || yp > INT_MAX - 1) {
+ return splashErrBadArg;
+ }
+ pixBuf = (SplashColorPtr)gmallocn(yp + 1, w);
// initialize the pixel pipe
pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
@@ -2208,9 +2212,12 @@ SplashError Splash::drawImage(SplashImageSource src, void *srcData,
xq = w % scaledWidth;
// allocate pixel buffers
- colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);
+ if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) {
+ return splashErrBadArg;
+ }
+ colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps);
if (srcAlpha) {
- alphaBuf = (Guchar *)gmalloc((yp + 1) * w);
+ alphaBuf = (Guchar *)gmallocn(yp + 1, w);
} else {
alphaBuf = NULL;
}
diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc
index 0cb1a752af5..62bbd8e8afb 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc
@@ -11,6 +11,7 @@
#endif
#include <stdio.h>
+#include <limits.h>
#include "gmem.h"
#include "SplashErrorCodes.h"
#include "SplashBitmap.h"
@@ -27,30 +28,48 @@ SplashBitmap::SplashBitmap(int widthA, int heightA, int rowPad,
mode = modeA;
switch (mode) {
case splashModeMono1:
- rowSize = (width + 7) >> 3;
+ if (width > 0) {
+ rowSize = (width + 7) >> 3;
+ } else {
+ rowSize = -1;
+ }
break;
case splashModeMono8:
- rowSize = width;
+ if (width > 0) {
+ rowSize = width;
+ } else {
+ rowSize = -1;
+ }
break;
case splashModeRGB8:
case splashModeBGR8:
- rowSize = width * 3;
+ if (width > 0 && width <= INT_MAX / 3) {
+ rowSize = width * 3;
+ } else {
+ rowSize = -1;
+ }
break;
#if SPLASH_CMYK
case splashModeCMYK8:
- rowSize = width * 4;
+ if (width > 0 && width <= INT_MAX / 4) {
+ rowSize = width * 4;
+ } else {
+ rowSize = -1;
+ }
break;
#endif
}
- rowSize += rowPad - 1;
- rowSize -= rowSize % rowPad;
- data = (SplashColorPtr)gmalloc(rowSize * height);
+ if (rowSize > 0) {
+ rowSize += rowPad - 1;
+ rowSize -= rowSize % rowPad;
+ }
+ data = (SplashColorPtr)gmallocn(height, rowSize);
if (!topDown) {
data += (height - 1) * rowSize;
rowSize = -rowSize;
}
if (alphaA) {
- alpha = (Guchar *)gmalloc(width * height);
+ alpha = (Guchar *)gmallocn(width, height);
} else {
alpha = NULL;
}
diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h
index 2a70d4b77d6..7bdaf14e43a 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h
+++ b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h
@@ -29,4 +29,6 @@
#define splashErrSingularMatrix 8 // matrix is singular
+#define splashErrBadArg 9 // bad argument
+
#endif
diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc
index 8a1a9e9a317..d5970aeb07b 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc
@@ -4301,7 +4301,7 @@ void PSOutputDev::doImageL1Sep(GfxImageColorMap *colorMap,
width, -height, height);
// allocate a line buffer
- lineBuf = (Guchar *)gmalloc(4 * width);
+ lineBuf = (Guchar *)gmallocn(width, 4);
// set up to process the data stream
imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc
index 812d00c39a3..368eddbaf24 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc
@@ -323,6 +323,10 @@ ImageStream::ImageStream(Stream *strA, int widthA, int nCompsA, int nBitsA) {
} else {
imgLineSize = nVals;
}
+ if (width > INT_MAX / nComps) {
+ // force a call to gmallocn(-1,...), which will throw an exception
+ imgLineSize = -1;
+ }
imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar));
imgIdx = nVals;
}
diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
index 6fbf8b5d032..4c78a9dc165 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
@@ -59,6 +59,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
objs = NULL;
objNums = NULL;
offsets = NULL;
+ ok = gFalse;
if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) {
goto err1;
@@ -85,6 +86,13 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
goto err1;
}
+ // this is an arbitrary limit to avoid integer overflow problems
+ // in the 'new Object[nObjects]' call (Acrobat apparently limits
+ // object streams to 100-200 objects)
+ if (nObjects > 1000000) {
+ error(-1, "Too many objects in an object stream");
+ goto err1;
+ }
objs = new Object[nObjects];
objNums = (int *)gmallocn(nObjects, sizeof(int));
offsets = (int *)gmallocn(nObjects, sizeof(int));
@@ -101,7 +109,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
obj1.free();
obj2.free();
delete parser;
-// gfree(offsets);
+// gfree(offsets);
goto err1;
}
objNums[i] = obj1.getInt();
@@ -111,7 +119,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
if (objNums[i] < 0 || offsets[i] < 0 ||
(i > 0 && offsets[i] < offsets[i-1])) {
delete parser;
-// gfree(offsets);
+// gfree(offsets);
goto err1;
}
}
@@ -140,11 +148,11 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
delete parser;
}
-// gfree(offsets);
+//gfree(offsets);
+ ok = gTrue;
err1:
objStr.free();
- return;
}
ObjectStream::~ObjectStream() {
@@ -818,6 +826,11 @@ Object *XRef::fetch(int num, int gen, Object *obj) {
delete objStr;
}
objStr = new ObjectStream(this, e->offset);
+ if (!objStr->isOk()) {
+ delete objStr;
+ objStr = NULL;
+ goto err;
+ }
}
objStr->getObject(e->gen, num, obj);
break;
diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h
index f244264b3de..dd71211466f 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h
+++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h
@@ -32,6 +32,8 @@ public:
// generation 0.
ObjectStream(XRef *xref, int objStrNumA);
+ GBool isOk() { return ok; }
+
~ObjectStream();
// Return the object number of this object stream.
@@ -46,12 +48,13 @@ public:
private:
- int objStrNum; // object number of the object stream
- int nObjects; // number of objects in the stream
- Object *objs; // the objects (length = nObjects)
- int *objNums; // the object numbers (length = nObjects)
- int *offsets; // the object offsets (length = nObjects)
+ int objStrNum; // object number of the object stream
+ int nObjects; // number of objects in the stream
+ Object *objs; // the objects (length = nObjects)
+ int *objNums; // the object numbers (length = nObjects)
+ int *offsets; // the object offsets (length = nObjects)
Guint firstOffset;
+ GBool ok;
};
diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h b/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h
index 49e72ad0eb3..ce3efc50784 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h
+++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h
@@ -17,7 +17,7 @@
//------------------------------------------------------------------------
// xpdf version
-#define xpdfVersion "3.02pl3"
+#define xpdfVersion "3.02pl4"
#define xpdfVersionNum 3.02
#define xpdfMajorVersion 3
#define xpdfMinorVersion 2