xpdf: updated to 3.02pl4

3 files changed, 287 insertions, 2 deletions

diff --git a/xpdf/.md5sum b/xpdf/.md5sum
index 5fef5d704..6676d4541 100644
--- a/xpdf/.md5sum
+++ b/xpdf/.md5sum
@@ -2,3 +2,4 @@
 877118786dfe27d1b7aa5a6759cc6e45  xpdf-3.02pl1.patch
 3a5cb165ae66781e0b21e6219ae06795  xpdf-3.02pl2.patch
 581963ede0fb5715e1a69f01b5b8ce63  xpdf-3.02pl3.patch
+70b752716798dd341a4bf890df5f6fdc  xpdf-3.02pl4.patch
diff --git a/xpdf/Pkgfile b/xpdf/Pkgfile
index 58ae9ee72..f471a7629 100644
--- a/xpdf/Pkgfile
+++ b/xpdf/Pkgfile
@@ -6,17 +6,19 @@
 
 name=xpdf
 version=3.02
-release=4
+release=5
 source=(ftp://ftp.foolabs.com/pub/xpdf/$name-$version.tar.gz
 	$name-${version}pl1.patch
 	$name-${version}pl2.patch
-	$name-${version}pl3.patch)
+	$name-${version}pl3.patch
+	$name-${version}pl4.patch)
 
 build() {
     cd $name-$version
     patch -p1 -i $SRC/$name-${version}pl1.patch
     patch -p1 -i $SRC/$name-${version}pl2.patch
     patch -p1 -i $SRC/$name-${version}pl3.patch
+    patch -p1 -i $SRC/$name-${version}pl4.patch
     ./configure \
 	--prefix=/usr \
         --with-Xm-library=/usr/lib \
diff --git a/xpdf/xpdf-3.02pl4.patch b/xpdf/xpdf-3.02pl4.patch
new file mode 100644
index 000000000..082d11750
--- /dev/null
+++ b/xpdf/xpdf-3.02pl4.patch
@@ -0,0 +1,282 @@
+*** xpdf-3.02.orig/xpdf/Stream.cc	Fri Jul 24 14:30:46 2009
+--- xpdf-3.02/xpdf/Stream.cc	Mon Oct  5 11:07:49 2009
+***************
+*** 323,328 ****
+--- 323,332 ----
+    } else {
+      imgLineSize = nVals;
+    }
++   if (width > INT_MAX / nComps) {
++     // force a call to gmallocn(-1,...), which will throw an exception
++     imgLineSize = -1;
++   }
+    imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar));
+    imgIdx = nVals;
+  }
+*** xpdf-3.02.orig/xpdf/PSOutputDev.cc	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/PSOutputDev.cc	Fri Oct  2 12:38:58 2009
+***************
+*** 4301,4307 ****
+  	     width, -height, height);
+  
+    // allocate a line buffer
+!   lineBuf = (Guchar *)gmalloc(4 * width);
+  
+    // set up to process the data stream
+    imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
+--- 4301,4307 ----
+  	     width, -height, height);
+  
+    // allocate a line buffer
+!   lineBuf = (Guchar *)gmallocn(width, 4);
+  
+    // set up to process the data stream
+    imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
+diff -r -c xpdf-3.02.orig/splash/Splash.cc xpdf-3.02/splash/Splash.cc
+*** xpdf-3.02.orig/splash/Splash.cc	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/splash/Splash.cc	Fri Aug 14 14:05:08 2009
+***************
+*** 12,17 ****
+--- 12,18 ----
+  
+  #include <stdlib.h>
+  #include <string.h>
++ #include <limits.h>
+  #include "gmem.h"
+  #include "SplashErrorCodes.h"
+  #include "SplashMath.h"
+***************
+*** 1912,1918 ****
+    xq = w % scaledWidth;
+  
+    // allocate pixel buffer
+!   pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);
+  
+    // initialize the pixel pipe
+    pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
+--- 1913,1922 ----
+    xq = w % scaledWidth;
+  
+    // allocate pixel buffer
+!   if (yp < 0 || yp > INT_MAX - 1) {
+!     return splashErrBadArg;
+!   }
+!   pixBuf = (SplashColorPtr)gmallocn(yp + 1, w);
+  
+    // initialize the pixel pipe
+    pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
+***************
+*** 2208,2216 ****
+    xq = w % scaledWidth;
+  
+    // allocate pixel buffers
+!   colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);
+    if (srcAlpha) {
+!     alphaBuf = (Guchar *)gmalloc((yp + 1) * w);
+    } else {
+      alphaBuf = NULL;
+    }
+--- 2212,2223 ----
+    xq = w % scaledWidth;
+  
+    // allocate pixel buffers
+!   if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) {
+!     return splashErrBadArg;
+!   }
+!   colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps);
+    if (srcAlpha) {
+!     alphaBuf = (Guchar *)gmallocn(yp + 1, w);
+    } else {
+      alphaBuf = NULL;
+    }
+diff -r -c xpdf-3.02.orig/splash/SplashErrorCodes.h xpdf-3.02/splash/SplashErrorCodes.h
+*** xpdf-3.02.orig/splash/SplashErrorCodes.h	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/splash/SplashErrorCodes.h	Fri Aug 14 14:03:46 2009
+***************
+*** 29,32 ****
+--- 29,34 ----
+  
+  #define splashErrSingularMatrix  8	// matrix is singular
+  
++ #define splashErrBadArg          9	// bad argument
++ 
+  #endif
+*** xpdf-3.02.orig/splash/SplashBitmap.cc	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/splash/SplashBitmap.cc	Wed Aug 19 14:55:39 2009
+***************
+*** 11,16 ****
+--- 11,17 ----
+  #endif
+  
+  #include <stdio.h>
++ #include <limits.h>
+  #include "gmem.h"
+  #include "SplashErrorCodes.h"
+  #include "SplashBitmap.h"
+***************
+*** 27,56 ****
+    mode = modeA;
+    switch (mode) {
+    case splashModeMono1:
+!     rowSize = (width + 7) >> 3;
+      break;
+    case splashModeMono8:
+!     rowSize = width;
+      break;
+    case splashModeRGB8:
+    case splashModeBGR8:
+!     rowSize = width * 3;
+      break;
+  #if SPLASH_CMYK
+    case splashModeCMYK8:
+!     rowSize = width * 4;
+      break;
+  #endif
+    }
+!   rowSize += rowPad - 1;
+!   rowSize -= rowSize % rowPad;
+!   data = (SplashColorPtr)gmalloc(rowSize * height);
+    if (!topDown) {
+      data += (height - 1) * rowSize;
+      rowSize = -rowSize;
+    }
+    if (alphaA) {
+!     alpha = (Guchar *)gmalloc(width * height);
+    } else {
+      alpha = NULL;
+    }
+--- 28,75 ----
+    mode = modeA;
+    switch (mode) {
+    case splashModeMono1:
+!     if (width > 0) {
+!       rowSize = (width + 7) >> 3;
+!     } else {
+!       rowSize = -1;
+!     }
+      break;
+    case splashModeMono8:
+!     if (width > 0) {
+!       rowSize = width;
+!     } else {
+!       rowSize = -1;
+!     }
+      break;
+    case splashModeRGB8:
+    case splashModeBGR8:
+!     if (width > 0 && width <= INT_MAX / 3) {
+!       rowSize = width * 3;
+!     } else {
+!       rowSize = -1;
+!     }
+      break;
+  #if SPLASH_CMYK
+    case splashModeCMYK8:
+!     if (width > 0 && width <= INT_MAX / 4) {
+!       rowSize = width * 4;
+!     } else {
+!       rowSize = -1;
+!     }
+      break;
+  #endif
+    }
+!   if (rowSize > 0) {
+!     rowSize += rowPad - 1;
+!     rowSize -= rowSize % rowPad;
+!   }
+!   data = (SplashColorPtr)gmallocn(height, rowSize);
+    if (!topDown) {
+      data += (height - 1) * rowSize;
+      rowSize = -rowSize;
+    }
+    if (alphaA) {
+!     alpha = (Guchar *)gmallocn(width, height);
+    } else {
+      alpha = NULL;
+    }
+*** xpdf-3.02.orig/xpdf/XRef.cc	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/XRef.cc	Tue Oct 13 11:57:24 2009
+***************
+*** 52,57 ****
+--- 52,59 ----
+    // generation 0.
+    ObjectStream(XRef *xref, int objStrNumA);
+  
++   GBool isOk() { return ok; }
++ 
+    ~ObjectStream();
+  
+    // Return the object number of this object stream.
+***************
+*** 67,72 ****
+--- 69,75 ----
+    int nObjects;			// number of objects in the stream
+    Object *objs;			// the objects (length = nObjects)
+    int *objNums;			// the object numbers (length = nObjects)
++   GBool ok;
+  };
+  
+  ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
+***************
+*** 80,85 ****
+--- 83,89 ----
+    nObjects = 0;
+    objs = NULL;
+    objNums = NULL;
++   ok = gFalse;
+  
+    if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) {
+      goto err1;
+***************
+*** 105,110 ****
+--- 109,121 ----
+      goto err1;
+    }
+  
++   // this is an arbitrary limit to avoid integer overflow problems
++   // in the 'new Object[nObjects]' call (Acrobat apparently limits
++   // object streams to 100-200 objects)
++   if (nObjects > 1000000) {
++     error(-1, "Too many objects in an object stream");
++     goto err1;
++   }
+    objs = new Object[nObjects];
+    objNums = (int *)gmallocn(nObjects, sizeof(int));
+    offsets = (int *)gmallocn(nObjects, sizeof(int));
+***************
+*** 161,170 ****
+    }
+  
+    gfree(offsets);
+  
+   err1:
+    objStr.free();
+-   return;
+  }
+  
+  ObjectStream::~ObjectStream() {
+--- 172,181 ----
+    }
+  
+    gfree(offsets);
++   ok = gTrue;
+  
+   err1:
+    objStr.free();
+  }
+  
+  ObjectStream::~ObjectStream() {
+***************
+*** 837,842 ****
+--- 848,858 ----
+  	delete objStr;
+        }
+        objStr = new ObjectStream(this, e->offset);
++       if (!objStr->isOk()) {
++ 	delete objStr;
++ 	objStr = NULL;
++ 	goto err;
++       }
+      }
+      objStr->getObject(e->gen, num, obj);
+      break;