diff options
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | pdf/xpdf/Gfx.cc | 4 | ||||
-rw-r--r-- | pdf/xpdf/GfxState.cc | 7 |
3 files changed, 16 insertions, 2 deletions
@@ -1,5 +1,12 @@ 2005-01-05 Marco Pesenti Gritti <marco@gnome.org> + * pdf/xpdf/Gfx.cc: + * pdf/xpdf/GfxState.cc: + + Fix for CAN-2004-1125 + +2005-01-05 Marco Pesenti Gritti <marco@gnome.org> + * shell/ev-view.c: (ev_view_copy): * shell/ev-view.h: * shell/ev-window.c: (ev_window_cmd_edit_copy): diff --git a/pdf/xpdf/Gfx.cc b/pdf/xpdf/Gfx.cc index a52aa02..e530213 100644 --- a/pdf/xpdf/Gfx.cc +++ b/pdf/xpdf/Gfx.cc @@ -2654,7 +2654,9 @@ void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) { haveMask = gFalse; dict->lookup("Mask", &maskObj); if (maskObj.isArray()) { - for (i = 0; i < maskObj.arrayGetLength(); ++i) { + for (i = 0; + i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps; + ++i) { maskObj.arrayGet(i, &obj1); maskColors[i] = obj1.getInt(); obj1.free(); diff --git a/pdf/xpdf/GfxState.cc b/pdf/xpdf/GfxState.cc index be60405..92e5ebb 100644 --- a/pdf/xpdf/GfxState.cc +++ b/pdf/xpdf/GfxState.cc @@ -714,6 +714,11 @@ GfxColorSpace *GfxICCBasedColorSpace::parse(Array *arr) { } nCompsA = obj2.getInt(); obj2.free(); + if (nCompsA > gfxColorMaxComps) { + error(-1, "ICCBased color space with too many (%d > %d) components", + nCompsA, gfxColorMaxComps); + nCompsA = gfxColorMaxComps; + } if (dict->lookup("Alternate", &obj2)->isNull() || !(altA = GfxColorSpace::parse(&obj2))) { switch (nCompsA) { @@ -1060,7 +1065,7 @@ GfxColorSpace *GfxDeviceNColorSpace::parse(Array *arr) { } nCompsA = obj1.arrayGetLength(); if (nCompsA > gfxColorMaxComps) { - error(-1, "DeviceN color space with more than %d > %d components", + error(-1, "DeviceN color space with too many (%d > %d) components", nCompsA, gfxColorMaxComps); nCompsA = gfxColorMaxComps; } |