From fe79f318025f3d4188ffae602b44724454ee1461 Mon Sep 17 00:00:00 2001
From: Justin Blanchard <justinb04@aim.com>
Date: Tue, 14 Aug 2007 03:48:35 +0000
Subject: Fixes invalid read, see bug #466401.

2007-08-14  Justin Blanchard  <justinb04@aim.com>

	* shell/ev-page-cache.c: (build_height_to_page),
	(ev_page_cache_get_height_to_page):
	
	Fixes invalid read, see bug #466401.


svn path=/trunk/; revision=2618
---
(limited to 'shell')

diff --git a/shell/ev-page-cache.c b/shell/ev-page-cache.c
index ebf0de7..ddbeb0f 100644
--- a/shell/ev-page-cache.c
+++ b/shell/ev-page-cache.c
@@ -174,10 +174,14 @@ build_height_to_page (EvPageCache *page_cache)
 			}
 			page_cache->height_to_page [i] = i * uniform_height;
 		} else {
-			if (!swap) {
-				page_height = page_cache->size_cache [i].height;
+			if (i < page_cache->n_pages) {
+				if (!swap) {
+					page_height = page_cache->size_cache [i].height;
+				} else {
+					page_height = page_cache->size_cache [i].width;
+				}
 			} else {
-				page_height = page_cache->size_cache [i].width;
+				page_height = 0;
 			}
 			page_cache->height_to_page [i] = saved_height;
 			saved_height += page_height;
@@ -502,6 +506,9 @@ ev_page_cache_get_height_to_page (EvPageCache   *page_cache,
 				  gint 	        *dual_height)
 {
 	g_return_if_fail (EV_IS_PAGE_CACHE (page_cache));
+	g_return_if_fail (page >= 0);
+	g_return_if_fail (!height || page <= page_cache->n_pages);
+	g_return_if_fail (!dual_height || page <= page_cache->n_pages + 1);
 
 	if (page_cache->rotation != rotation) {
 		page_cache->rotation = rotation;
--
cgit v0.9.1