eb36cb
From b224e2f5739fe61de9fa69955d016725b2a4b78d Mon Sep 17 00:00:00 2001
eb36cb
From: Albert Astals Cid <aacid@kde.org>
eb36cb
Date: Mon, 15 Jul 2019 22:11:09 +0200
eb36cb
Subject: [PATCH] SplashOutputDev::tilingPatternFill: Fix crash on broken file
eb36cb
eb36cb
Issue #802
eb36cb
---
eb36cb
 poppler/SplashOutputDev.cc | 4 ++++
eb36cb
 1 file changed, 4 insertions(+)
eb36cb
eb36cb
diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
eb36cb
index 544f132d..3d2befc2 100644
eb36cb
--- a/poppler/SplashOutputDev.cc
eb36cb
+++ b/poppler/SplashOutputDev.cc
eb36cb
@@ -4581,6 +4581,10 @@ bool SplashOutputDev::tilingPatternFill(GfxState *state, Gfx *gfxA, Catalog *cat
eb36cb
     surface_width = (int) ceil (fabs(kx));
eb36cb
     surface_height = (int) ceil (fabs(ky));
eb36cb
     // adjust repeat values to completely fill region
eb36cb
+    if (unlikely(surface_width == 0 || surface_height == 0)) {
eb36cb
+        state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]);
eb36cb
+        return gFalse;
eb36cb
+    }
eb36cb
     repeatX = result_width / surface_width;
eb36cb
     repeatY = result_height / surface_height;
eb36cb
     if (surface_width * repeatX < result_width)
eb36cb
-- 
eb36cb
2.24.1
eb36cb