diff options
author | Marco Pesenti Gritti <marco@gnome.org> | 2005-01-05 16:52:28 (GMT) |
---|---|---|
committer | Marco Pesenti Gritti <marco@src.gnome.org> | 2005-01-05 16:52:28 (GMT) |
commit | 3f13c6e2f982c586d656492eeb455586109e0e28 (patch) | |
tree | 598d3f8da30ed3af4d9aa0464841b2fe2432dec4 | |
parent | 8195f1f7c4693838e73f23ab95ba60707faf6446 (diff) |
Fix for CAN-2004-1125
2005-01-05 Marco Pesenti Gritti <marco@gnome.org>
* pdf/xpdf/Gfx.cc:
* pdf/xpdf/GfxState.cc:
Fix for CAN-2004-1125
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | pdf/xpdf/Gfx.cc | 4 | ||||
-rw-r--r-- | pdf/xpdf/GfxState.cc | 7 |
3 files changed, 16 insertions, 2 deletions
@@ -1,5 +1,12 @@ 2005-01-05 Marco Pesenti Gritti <marco@gnome.org> + * pdf/xpdf/Gfx.cc: + * pdf/xpdf/GfxState.cc: + + Fix for CAN-2004-1125 + +2005-01-05 Marco Pesenti Gritti <marco@gnome.org> + * shell/ev-view.c: (ev_view_copy): * shell/ev-view.h: * shell/ev-window.c: (ev_window_cmd_edit_copy): diff --git a/pdf/xpdf/Gfx.cc b/pdf/xpdf/Gfx.cc index a52aa02..e530213 100644 --- a/pdf/xpdf/Gfx.cc +++ b/pdf/xpdf/Gfx.cc @@ -2654,7 +2654,9 @@ void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) { haveMask = gFalse; dict->lookup("Mask", &maskObj); if (maskObj.isArray()) { - for (i = 0; i < maskObj.arrayGetLength(); ++i) { + for (i = 0; + i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps; + ++i) { maskObj.arrayGet(i, &obj1); maskColors[i] = obj1.getInt(); obj1.free(); diff --git a/pdf/xpdf/GfxState.cc b/pdf/xpdf/GfxState.cc index be60405..92e5ebb 100644 --- a/pdf/xpdf/GfxState.cc +++ b/pdf/xpdf/GfxState.cc @@ -714,6 +714,11 @@ GfxColorSpace *GfxICCBasedColorSpace::parse(Array *arr) { } nCompsA = obj2.getInt(); obj2.free(); + if (nCompsA > gfxColorMaxComps) { + error(-1, "ICCBased color space with too many (%d > %d) components", + nCompsA, gfxColorMaxComps); + nCompsA = gfxColorMaxComps; + } if (dict->lookup("Alternate", &obj2)->isNull() || !(altA = GfxColorSpace::parse(&obj2))) { switch (nCompsA) { @@ -1060,7 +1065,7 @@ GfxColorSpace *GfxDeviceNColorSpace::parse(Array *arr) { } nCompsA = obj1.arrayGetLength(); if (nCompsA > gfxColorMaxComps) { - error(-1, "DeviceN color space with more than %d > %d components", + error(-1, "DeviceN color space with too many (%d > %d) components", nCompsA, gfxColorMaxComps); nCompsA = gfxColorMaxComps; } |