diff options
author | Marco Pesenti Gritti <marco@gnome.org> | 2005-01-05 16:52:28 (GMT) |
---|---|---|
committer | Marco Pesenti Gritti <marco@src.gnome.org> | 2005-01-05 16:52:28 (GMT) |
commit | 3f13c6e2f982c586d656492eeb455586109e0e28 (patch) | |
tree | 598d3f8da30ed3af4d9aa0464841b2fe2432dec4 /pdf | |
parent | 8195f1f7c4693838e73f23ab95ba60707faf6446 (diff) |
Fix for CAN-2004-1125
2005-01-05 Marco Pesenti Gritti <marco@gnome.org>
* pdf/xpdf/Gfx.cc:
* pdf/xpdf/GfxState.cc:
Fix for CAN-2004-1125
Diffstat (limited to 'pdf')
-rw-r--r-- | pdf/xpdf/Gfx.cc | 4 | ||||
-rw-r--r-- | pdf/xpdf/GfxState.cc | 7 |
2 files changed, 9 insertions, 2 deletions
diff --git a/pdf/xpdf/Gfx.cc b/pdf/xpdf/Gfx.cc index a52aa02..e530213 100644 --- a/pdf/xpdf/Gfx.cc +++ b/pdf/xpdf/Gfx.cc @@ -2654,7 +2654,9 @@ void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) { haveMask = gFalse; dict->lookup("Mask", &maskObj); if (maskObj.isArray()) { - for (i = 0; i < maskObj.arrayGetLength(); ++i) { + for (i = 0; + i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps; + ++i) { maskObj.arrayGet(i, &obj1); maskColors[i] = obj1.getInt(); obj1.free(); diff --git a/pdf/xpdf/GfxState.cc b/pdf/xpdf/GfxState.cc index be60405..92e5ebb 100644 --- a/pdf/xpdf/GfxState.cc +++ b/pdf/xpdf/GfxState.cc @@ -714,6 +714,11 @@ GfxColorSpace *GfxICCBasedColorSpace::parse(Array *arr) { } nCompsA = obj2.getInt(); obj2.free(); + if (nCompsA > gfxColorMaxComps) { + error(-1, "ICCBased color space with too many (%d > %d) components", + nCompsA, gfxColorMaxComps); + nCompsA = gfxColorMaxComps; + } if (dict->lookup("Alternate", &obj2)->isNull() || !(altA = GfxColorSpace::parse(&obj2))) { switch (nCompsA) { @@ -1060,7 +1065,7 @@ GfxColorSpace *GfxDeviceNColorSpace::parse(Array *arr) { } nCompsA = obj1.arrayGetLength(); if (nCompsA > gfxColorMaxComps) { - error(-1, "DeviceN color space with more than %d > %d components", + error(-1, "DeviceN color space with too many (%d > %d) components", nCompsA, gfxColorMaxComps); nCompsA = gfxColorMaxComps; } |