Index: xpdf/splash/Splash.cc
===================================================================
--- xpdf/splash/Splash.cc	(revision 498958)
+++ xpdf/splash/Splash.cc	(working copy)
@@ -928,6 +928,10 @@ void Splash::drawPixel(int x, int y, Spl
   int alpha2, ialpha2;
   Guchar t;
 
+  if ( (unsigned) x >= (unsigned) bitmap->getWidth() ||
+       (unsigned) y >= (unsigned) bitmap->getHeight())
+    return;
+
   if (noClip || state->clip->test(x, y)) {
     if (alpha != 1 || softMask || state->blendFunc) {
       blendFunc = state->blendFunc ? state->blendFunc : &blendNormal;
@@ -1195,6 +1199,11 @@ void Splash::drawSpan(int x0, int x1, in
     updateModY(y);
   }
 
+  if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) y >= (unsigned) bitmap->getHeight())
+    return;
+
   if (alpha != 1 || softMask || state->blendFunc) {
     blendFunc = state->blendFunc ? state->blendFunc : &blendNormal;
     if (softMask) {
@@ -1825,6 +1834,11 @@ void Splash::xorSpan(int x0, int x1, int
     updateModY(y);
   }
 
+  if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) y >= (unsigned) bitmap->getHeight())
+    return;
+
   switch (bitmap->mode) {
   case splashModeMono1:
     p = &bitmap->data[y * bitmap->rowSize + (x0 >> 3)];