2418db
From 92e41685dcef538a7fc669ca357ce9f448a8078e Mon Sep 17 00:00:00 2001
2418db
From: Albert Astals Cid <aacid@kde.org>
2418db
Date: Sat, 7 Feb 2015 21:54:39 +0100
2418db
Subject: Fix crash in malformed file from bug #85275
2418db
2418db
2418db
diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
2418db
index 97af5c4..6640ab5 100644
2418db
--- a/poppler/SplashOutputDev.cc
2418db
+++ b/poppler/SplashOutputDev.cc
2418db
@@ -4048,8 +4048,8 @@ void SplashOutputDev::setSoftMask(GfxState *state, double *bbox,
2418db
   p = softMask->getDataPtr() + ty * softMask->getRowSize() + tx;
2418db
   int xMax = tBitmap->getWidth();
2418db
   int yMax = tBitmap->getHeight();
2418db
-  if (xMax + tx > bitmap->getWidth()) xMax = bitmap->getWidth() - tx;
2418db
-  if (yMax + ty > bitmap->getHeight()) yMax = bitmap->getHeight() - ty;
2418db
+  if (xMax > bitmap->getWidth() - tx) xMax = bitmap->getWidth() - tx;
2418db
+  if (yMax > bitmap->getHeight() - ty) yMax = bitmap->getHeight() - ty;
2418db
   for (y = 0; y < yMax; ++y) {
2418db
     for (x = 0; x < xMax; ++x) {
2418db
       if (alpha) {
2418db
diff --git a/splash/Splash.cc b/splash/Splash.cc
2418db
index fde272a..142516f 100644
2418db
--- a/splash/Splash.cc
2418db
+++ b/splash/Splash.cc
2418db
@@ -11,7 +11,7 @@
2418db
 // All changes made under the Poppler project to this file are licensed
2418db
 // under GPL version 2 or later
2418db
 //
2418db
-// Copyright (C) 2005-2014 Albert Astals Cid <aacid@kde.org>
2418db
+// Copyright (C) 2005-2015 Albert Astals Cid <aacid@kde.org>
2418db
 // Copyright (C) 2005 Marco Pesenti Gritti <mpg@redhat.com>
2418db
 // Copyright (C) 2010-2014 Thomas Freitag <thomas.freitag@alfa.de>
2418db
 // Copyright (C) 2010 Christian Feuersänger <cfeuersaenger@googlemail.com>
2418db
@@ -5214,6 +5214,10 @@ SplashError Splash::composite(SplashBitmap *src, int xSrc, int ySrc,
2418db
     return splashErrModeMismatch;
2418db
   }
2418db
 
2418db
+  if (unlikely(!bitmap->data)) {
2418db
+    return splashErrZeroImage;
2418db
+  }
2418db
+
2418db
   if(src->getSeparationList()->getLength() > bitmap->getSeparationList()->getLength()) {
2418db
     for (x = bitmap->getSeparationList()->getLength(); x < src->getSeparationList()->getLength(); x++)
2418db
       bitmap->getSeparationList()->append(((GfxSeparationColorSpace *)src->getSeparationList()->get(x))->copy());
2418db
@@ -5783,6 +5787,10 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
2418db
     return splashErrModeMismatch;
2418db
   }
2418db
 
2418db
+  if (unlikely(!bitmap->data)) {
2418db
+    return splashErrZeroImage;
2418db
+  }
2418db
+
2418db
   switch (bitmap->mode) {
2418db
   case splashModeMono1:
2418db
     for (y = 0; y < h; ++y) {
2418db
diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc
2418db
index ac344f1..e886683 100644
2418db
--- a/splash/SplashBitmap.cc
2418db
+++ b/splash/SplashBitmap.cc
2418db
@@ -11,7 +11,7 @@
2418db
 // All changes made under the Poppler project to this file are licensed
2418db
 // under GPL version 2 or later
2418db
 //
2418db
-// Copyright (C) 2006, 2009, 2010, 2012 Albert Astals Cid <aacid@kde.org>
2418db
+// Copyright (C) 2006, 2009, 2010, 2012, 2015 Albert Astals Cid <aacid@kde.org>
2418db
 // Copyright (C) 2007 Ilmari Heikkinen <ilmari.heikkinen@gmail.com>
2418db
 // Copyright (C) 2009 Shen Liang <shenzhuxi@gmail.com>
2418db
 // Copyright (C) 2009 Stefan Thomas <thomas@eload24.com>
2418db
@@ -275,7 +275,7 @@ SplashError SplashBitmap::writeAlphaPGMFile(char *fileName) {
2418db
 void SplashBitmap::getPixel(int x, int y, SplashColorPtr pixel) {
2418db
   SplashColorPtr p;
2418db
 
2418db
-  if (y < 0 || y >= height || x < 0 || x >= width) {
2418db
+  if (y < 0 || y >= height || x < 0 || x >= width || !data) {
2418db
     return;
2418db
   }
2418db
   switch (mode) {
2418db
-- 
2418db
cgit v0.10.2
2418db