Attachment #59900 for bug #90069

View | Details | Raw Unified | Return to bug 90069
Collapse All | Expand All

Lines 8-14 Link Here

(-)Makefile (-2 / +2 lines)
8		8
9	PORTNAME= pdftohtml	9	PORTNAME= pdftohtml
10	PORTVERSION= 0.36	10	PORTVERSION= 0.36
11	PORTREVISION= 2	11	PORTREVISION= 3
12	CATEGORIES= textproc	12	CATEGORIES= textproc
13	MASTER_SITES= ${MASTER_SITE_SOURCEFORGE}	13	MASTER_SITES= ${MASTER_SITE_SOURCEFORGE}
14	MASTER_SITE_SUBDIR= ${PORTNAME}	14	MASTER_SITE_SUBDIR= ${PORTNAME}
Lines 22-28 Link Here
22	GSPORT?= print/ghostscript-gnu	22	GSPORT?= print/ghostscript-gnu
23	.endif	23	.endif
24		24
25	RUN_DEPENDS= ${LOCALBASE}/bin/gs:${PORTSDIR}/${GSPORT}	25	RUN_DEPENDS+= ${LOCALBASE}/bin/gs:${PORTSDIR}/${GSPORT}
26		26
27	PLIST_FILES= bin/pdftohtml	27	PLIST_FILES= bin/pdftohtml
28	WRKSRC= ${WRKDIR}/${DISTNAME}	28	WRKSRC= ${WRKDIR}/${DISTNAME}




--- xpdf/Stream.cc.orig	Mon May 17 16:37:57 2004
+++ xpdf/Stream.cc	Tue Dec  6 18:05:14 2005
@@ -407,18 +407,33 @@
 
 StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
 				 int widthA, int nCompsA, int nBitsA) {
+  int totalBits;
+
   str = strA;
   predictor = predictorA;
   width = widthA;
   nComps = nCompsA;
   nBits = nBitsA;
+  predLine = NULL;
+  ok = gFalse;
 
   nVals = width * nComps;
+  totalBits = nVals * nBits;
+  if (totalBits == 0 ||
+      (totalBits / nBits) / nComps != width ||
+      totalBits + 7 < 0) {
+    return;
+  }
   pixBytes = (nComps * nBits + 7) >> 3;
-  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+  rowBytes = ((totalBits + 7) >> 3) + pixBytes;
+  if (rowBytes < 0) {
+    return;
+  }
   predLine = (Guchar *)gmalloc(rowBytes);
   memset(predLine, 0, rowBytes);
   predIdx = rowBytes;
+
+  ok = gTrue;
 }
 
 StreamPredictor::~StreamPredictor() {
@@ -1012,6 +1027,10 @@
     FilterStream(strA) {
   if (predictor != 1) {
     pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
   } else {
     pred = NULL;
   }
@@ -2897,6 +2916,14 @@
   height = read16();
   width = read16();
   numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream", prec);
+    return gFalse;
+  }
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream", prec);
+    return gFalse;
+  }
   if (prec != 8) {
     error(getPos(), "Bad DCT precision %d", prec);
     return gFalse;
@@ -3255,6 +3282,10 @@
     FilterStream(strA) {
   if (predictor != 1) {
     pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
   } else {
     pred = NULL;
   }
--- xpdf/Stream.h.orig	Mon May 17 16:37:57 2004
+++ xpdf/Stream.h	Tue Dec  6 18:05:14 2005
@@ -233,6 +233,8 @@
 
   ~StreamPredictor();
 
+  GBool isOk() { return ok; }
+
   int lookChar();
   int getChar();
 
@@ -250,6 +252,7 @@
   int rowBytes;			// bytes per line
   Guchar *predLine;		// line buffer
   int predIdx;			// current index in predLine
+  GBool ok;
 };
 
 //------------------------------------------------------------------------

Return to bug 90069

Added Link Here

(-)files/patch-SA17897 (+93 lines)
1	--- xpdf/Stream.cc.orig Mon May 17 16:37:57 2004
2	+++ xpdf/Stream.cc Tue Dec 6 18:05:14 2005
3	@@ -407,18 +407,33 @@
4
5	StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
6	int widthA, int nCompsA, int nBitsA) {
7	+ int totalBits;
8	+
9	str = strA;
10	predictor = predictorA;
11	width = widthA;
12	nComps = nCompsA;
13	nBits = nBitsA;
14	+ predLine = NULL;
15	+ ok = gFalse;
16
17	nVals = width * nComps;
18	+ totalBits = nVals * nBits;
19	+ if (totalBits == 0 \|\|
20	+ (totalBits / nBits) / nComps != width \|\|
21	+ totalBits + 7 < 0) {
22	+ return;
23	+ }
24	pixBytes = (nComps * nBits + 7) >> 3;
25	- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
26	+ rowBytes = ((totalBits + 7) >> 3) + pixBytes;
27	+ if (rowBytes < 0) {
28	+ return;
29	+ }
30	predLine = (Guchar *)gmalloc(rowBytes);
31	memset(predLine, 0, rowBytes);
32	predIdx = rowBytes;
33	+
34	+ ok = gTrue;
35	}
36
37	StreamPredictor::~StreamPredictor() {
38	@@ -1012,6 +1027,10 @@
39	FilterStream(strA) {
40	if (predictor != 1) {
41	pred = new StreamPredictor(this, predictor, columns, colors, bits);
42	+ if (!pred->isOk()) {
43	+ delete pred;
44	+ pred = NULL;
45	+ }
46	} else {
47	pred = NULL;
48	}
49	@@ -2897,6 +2916,14 @@
50	height = read16();
51	width = read16();
52	numComps = str->getChar();
53	+ if (numComps <= 0 \|\| numComps > 4) {
54	+ error(getPos(), "Bad number of components in DCT stream", prec);
55	+ return gFalse;
56	+ }
57	+ if (numComps <= 0 \|\| numComps > 4) {
58	+ error(getPos(), "Bad number of components in DCT stream", prec);
59	+ return gFalse;
60	+ }
61	if (prec != 8) {
62	error(getPos(), "Bad DCT precision %d", prec);
63	return gFalse;
64	@@ -3255,6 +3282,10 @@
65	FilterStream(strA) {
66	if (predictor != 1) {
67	pred = new StreamPredictor(this, predictor, columns, colors, bits);
68	+ if (!pred->isOk()) {
69	+ delete pred;
70	+ pred = NULL;
71	+ }
72	} else {
73	pred = NULL;
74	}
75	--- xpdf/Stream.h.orig Mon May 17 16:37:57 2004
76	+++ xpdf/Stream.h Tue Dec 6 18:05:14 2005
77	@@ -233,6 +233,8 @@
78
79	~StreamPredictor();
80
81	+ GBool isOk() { return ok; }
82	+
83	int lookChar();
84	int getChar();
85
86	@@ -250,6 +252,7 @@
87	int rowBytes; // bytes per line
88	Guchar *predLine; // line buffer
89	int predIdx; // current index in predLine
90	+ GBool ok;
91	};
92
93	//------------------------------------------------------------------------