xpdf/xpdf-3.01-cve_2006_0301.patch

40 lines
1.4 KiB
Diff

Index: xpdf/splash/Splash.cc
===================================================================
--- xpdf/splash/Splash.cc (revision 498958)
+++ xpdf/splash/Splash.cc (working copy)
@@ -928,6 +928,10 @@ void Splash::drawPixel(int x, int y, Spl
int alpha2, ialpha2;
Guchar t;
+ if ( (unsigned) x >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
if (noClip || state->clip->test(x, y)) {
if (alpha != 1 || softMask || state->blendFunc) {
blendFunc = state->blendFunc ? state->blendFunc : &blendNormal;
@@ -1195,6 +1199,11 @@ void Splash::drawSpan(int x0, int x1, in
updateModY(y);
}
+ if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
if (alpha != 1 || softMask || state->blendFunc) {
blendFunc = state->blendFunc ? state->blendFunc : &blendNormal;
if (softMask) {
@@ -1825,6 +1834,11 @@ void Splash::xorSpan(int x0, int x1, int
updateModY(y);
}
+ if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
switch (bitmap->mode) {
case splashModeMono1:
p = &bitmap->data[y * bitmap->rowSize + (x0 >> 3)];