|
 |
2418db |
From 92e41685dcef538a7fc669ca357ce9f448a8078e Mon Sep 17 00:00:00 2001
|
|
|
2418db |
From: Albert Astals Cid <aacid@kde.org>
|
|
|
2418db |
Date: Sat, 7 Feb 2015 21:54:39 +0100
|
|
|
2418db |
Subject: Fix crash in malformed file from bug #85275
|
|
|
2418db |
|
|
|
2418db |
|
|
|
2418db |
diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
|
|
|
2418db |
index 97af5c4..6640ab5 100644
|
|
|
2418db |
--- a/poppler/SplashOutputDev.cc
|
|
|
2418db |
+++ b/poppler/SplashOutputDev.cc
|
|
|
2418db |
@@ -4048,8 +4048,8 @@ void SplashOutputDev::setSoftMask(GfxState *state, double *bbox,
|
|
|
2418db |
p = softMask->getDataPtr() + ty * softMask->getRowSize() + tx;
|
|
|
2418db |
int xMax = tBitmap->getWidth();
|
|
|
2418db |
int yMax = tBitmap->getHeight();
|
|
|
2418db |
- if (xMax + tx > bitmap->getWidth()) xMax = bitmap->getWidth() - tx;
|
|
|
2418db |
- if (yMax + ty > bitmap->getHeight()) yMax = bitmap->getHeight() - ty;
|
|
|
2418db |
+ if (xMax > bitmap->getWidth() - tx) xMax = bitmap->getWidth() - tx;
|
|
|
2418db |
+ if (yMax > bitmap->getHeight() - ty) yMax = bitmap->getHeight() - ty;
|
|
|
2418db |
for (y = 0; y < yMax; ++y) {
|
|
|
2418db |
for (x = 0; x < xMax; ++x) {
|
|
|
2418db |
if (alpha) {
|
|
|
2418db |
diff --git a/splash/Splash.cc b/splash/Splash.cc
|
|
|
2418db |
index fde272a..142516f 100644
|
|
|
2418db |
--- a/splash/Splash.cc
|
|
|
2418db |
+++ b/splash/Splash.cc
|
|
|
2418db |
@@ -11,7 +11,7 @@
|
|
|
2418db |
// All changes made under the Poppler project to this file are licensed
|
|
|
2418db |
// under GPL version 2 or later
|
|
|
2418db |
//
|
|
|
2418db |
-// Copyright (C) 2005-2014 Albert Astals Cid <aacid@kde.org>
|
|
|
2418db |
+// Copyright (C) 2005-2015 Albert Astals Cid <aacid@kde.org>
|
|
|
2418db |
// Copyright (C) 2005 Marco Pesenti Gritti <mpg@redhat.com>
|
|
|
2418db |
// Copyright (C) 2010-2014 Thomas Freitag <Thomas.Freitag@alfa.de>
|
|
|
2418db |
// Copyright (C) 2010 Christian Feuersänger <cfeuersaenger@googlemail.com>
|
|
|
2418db |
@@ -5214,6 +5214,10 @@ SplashError Splash::composite(SplashBitmap *src, int xSrc, int ySrc,
|
|
|
2418db |
return splashErrModeMismatch;
|
|
|
2418db |
}
|
|
|
2418db |
|
|
|
2418db |
+ if (unlikely(!bitmap->data)) {
|
|
|
2418db |
+ return splashErrZeroImage;
|
|
|
2418db |
+ }
|
|
|
2418db |
+
|
|
|
2418db |
if(src->getSeparationList()->getLength() > bitmap->getSeparationList()->getLength()) {
|
|
|
2418db |
for (x = bitmap->getSeparationList()->getLength(); x < src->getSeparationList()->getLength(); x++)
|
|
|
2418db |
bitmap->getSeparationList()->append(((GfxSeparationColorSpace *)src->getSeparationList()->get(x))->copy());
|
|
|
2418db |
@@ -5783,6 +5787,10 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
|
|
2418db |
return splashErrModeMismatch;
|
|
|
2418db |
}
|
|
|
2418db |
|
|
|
2418db |
+ if (unlikely(!bitmap->data)) {
|
|
|
2418db |
+ return splashErrZeroImage;
|
|
|
2418db |
+ }
|
|
|
2418db |
+
|
|
|
2418db |
switch (bitmap->mode) {
|
|
|
2418db |
case splashModeMono1:
|
|
|
2418db |
for (y = 0; y < h; ++y) {
|
|
|
2418db |
diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc
|
|
|
2418db |
index ac344f1..e886683 100644
|
|
|
2418db |
--- a/splash/SplashBitmap.cc
|
|
|
2418db |
+++ b/splash/SplashBitmap.cc
|
|
|
2418db |
@@ -11,7 +11,7 @@
|
|
|
2418db |
// All changes made under the Poppler project to this file are licensed
|
|
|
2418db |
// under GPL version 2 or later
|
|
|
2418db |
//
|
|
|
2418db |
-// Copyright (C) 2006, 2009, 2010, 2012 Albert Astals Cid <aacid@kde.org>
|
|
|
2418db |
+// Copyright (C) 2006, 2009, 2010, 2012, 2015 Albert Astals Cid <aacid@kde.org>
|
|
|
2418db |
// Copyright (C) 2007 Ilmari Heikkinen <ilmari.heikkinen@gmail.com>
|
|
|
2418db |
// Copyright (C) 2009 Shen Liang <shenzhuxi@gmail.com>
|
|
|
2418db |
// Copyright (C) 2009 Stefan Thomas <thomas@eload24.com>
|
|
|
2418db |
@@ -275,7 +275,7 @@ SplashError SplashBitmap::writeAlphaPGMFile(char *fileName) {
|
|
|
2418db |
void SplashBitmap::getPixel(int x, int y, SplashColorPtr pixel) {
|
|
|
2418db |
SplashColorPtr p;
|
|
|
2418db |
|
|
|
2418db |
- if (y < 0 || y >= height || x < 0 || x >= width) {
|
|
|
2418db |
+ if (y < 0 || y >= height || x < 0 || x >= width || !data) {
|
|
|
2418db |
return;
|
|
|
2418db |
}
|
|
|
2418db |
switch (mode) {
|
|
|
2418db |
--
|
|
|
2418db |
cgit v0.10.2
|
|
|
2418db |
|