Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-0.7.git;a=commitdiff;h=cd78d8e485edc69ccc576c6914fd6556e1679ee4
commit cd78d8e485edc69ccc576c6914fd6556e1679ee4 Author: voroskoi <[EMAIL PROTECTED]> Date: Tue Nov 27 23:32:13 2007 +0100 cups-1.3.2-2sayshell2-i686 secfix relbump, closes #2596 diff --git a/source/apps/cups/FrugalBuild b/source/apps/cups/FrugalBuild index 9ce9b4a..5645d49 100644 --- a/source/apps/cups/FrugalBuild +++ b/source/apps/cups/FrugalBuild @@ -4,7 +4,7 @@ pkgname=cups pkgver=1.3.2 -pkgrel=2sayshell1 +pkgrel=2sayshell2 pkgdesc="The CUPS Printing System" url="http://www.cups.org/"; depends=('libtiff' 'libpng' 'libjpeg') @@ -14,7 +14,7 @@ archs=('i686' 'x86_64') backup=(etc/cups/{printers.conf,classes.conf,client.conf,cupsd.conf,mime.types,mime.convs}) up2date="lynx -dump $url |grep Stable |sed -e 's/.*v\(.*\)/\1/'" source=(ftp://ftp.easysw.com/pub/cups/$pkgver/cups-$pkgver-source.tar.bz2 \ - rc.cups rc.cups-{hu,de}.po CVE-2007-4351.diff) + rc.cups rc.cups-{hu,de}.po CVE-2007-4351.diff cups-xpdf.diff) subpkgs=('libcups') subdescs=('Main library of the CUPS printing system.') @@ -53,6 +53,7 @@ sha1sums=('6915f4499ac258a59afc5b3541b17f56b3bfb66f' \ 'ad90c43de181d362f6c507f366904472d01ae585' \ 'f19bb889e3535e1284d0b93606da48aa61089c8a' \ '03197abb98eff18d3ede3000a61c7783b8c1ad92' \ - '79b9bc071bb4ab0ccf032a51f815adf96264dd52') + '79b9bc071bb4ab0ccf032a51f815adf96264dd52' \ + 'c081ba7af9d0f3028c1c5a9b63cb15cdc5527c29') # optimization OK diff --git a/source/apps/cups/cups-xpdf.diff b/source/apps/cups/cups-xpdf.diff new file mode 100644 index 0000000..813f626 --- /dev/null +++ b/source/apps/cups/cups-xpdf.diff @@ -0,0 +1,798 @@ +diff -aur cups-1.3.4/pdftops/Stream.cxx fw_cups-1.3.4/pdftops/Stream.cxx +--- cups-1.3.4/pdftops/Stream.cxx 2007-07-30 21:53:15.000000000 +0200 ++++ fw_cups-1.3.4/pdftops/Stream.cxx 2007-11-23 09:59:16.000000000 +0100 +@@ -1274,23 +1274,26 @@ + columns = columnsA; + if (columns < 1) { + columns = 1; +- } +- if (columns + 4 <= 0) { +- columns = INT_MAX - 4; ++ } else if (columns > INT_MAX - 2) { ++ columns = INT_MAX - 2; + } + rows = rowsA; + endOfBlock = endOfBlockA; + black = blackA; +- refLine = (short *)gmallocn(columns + 4, sizeof(short)); +- codingLine = (short *)gmallocn(columns + 3, sizeof(short)); ++ // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns ++ // ---> max codingLine size = columns + 1 ++ // refLine has one extra guard entry at the end ++ // ---> max refLine size = columns + 2 ++ codingLine = (int *)gmallocn(columns + 1, sizeof(int)); ++ refLine = (int *)gmallocn(columns + 2, sizeof(int)); + + eof = gFalse; + row = 0; + nextLine2D = encoding < 0; + inputBits = 0; +- codingLine[0] = 0; +- codingLine[1] = refLine[2] = columns; +- a0 = 1; ++ codingLine[0] = columns; ++ a0i = 0; ++ outputBits = 0; + + buf = EOF; + } +@@ -1309,9 +1312,9 @@ + row = 0; + nextLine2D = encoding < 0; + inputBits = 0; +- codingLine[0] = 0; +- codingLine[1] = refLine[2] = columns; +- a0 = 1; ++ codingLine[0] = columns; ++ a0i = 0; ++ outputBits = 0; + buf = EOF; + + // skip any initial zero bits and end-of-line marker, and get the 2D +@@ -1328,284 +1331,357 @@ + } + } + +-int CCITTFaxStream::lookChar() { +- short code1, code2, code3; +- int a0New; +- GBool err, gotEOL; +- int ret; +- int bits, i; +- +- // if at eof just return EOF +- if (eof && codingLine[a0] >= columns) { +- return EOF; +- } +- +- // read the next row +- err = gFalse; +- if (codingLine[a0] >= columns) { +- +- // 2-D encoding +- if (nextLine2D) { +- for (i = 0; codingLine[i] < columns; ++i) +- refLine[i] = codingLine[i]; +- refLine[i] = refLine[i + 1] = columns; +- b1 = 1; +- a0New = codingLine[a0 = 0] = 0; +- do { +- code1 = getTwoDimCode(); +- switch (code1) { +- case twoDimPass: +- if (refLine[b1] < columns) { +- a0New = refLine[b1 + 1]; +- b1 += 2; +- } +- break; +- case twoDimHoriz: +- if ((a0 & 1) == 0) { +- code1 = code2 = 0; +- do { +- code1 += code3 = getWhiteCode(); +- } while (code3 >= 64); +- do { +- code2 += code3 = getBlackCode(); +- } while (code3 >= 64); +- } else { +- code1 = code2 = 0; +- do { +- code1 += code3 = getBlackCode(); +- } while (code3 >= 64); +- do { +- code2 += code3 = getWhiteCode(); +- } while (code3 >= 64); +- } +- if (code1 > 0 || code2 > 0) { +- codingLine[a0 + 1] = a0New + code1; +- ++a0; +- a0New = codingLine[a0 + 1] = codingLine[a0] + code2; +- ++a0; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVert0: +- a0New = codingLine[++a0] = refLine[b1]; +- if (refLine[b1] < columns) { +- ++b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVertR1: +- a0New = codingLine[++a0] = refLine[b1] + 1; +- if (refLine[b1] < columns) { +- ++b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVertL1: +- if (a0 == 0 || refLine[b1] - 1 > a0New) { +- a0New = codingLine[++a0] = refLine[b1] - 1; +- --b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVertR2: +- a0New = codingLine[++a0] = refLine[b1] + 2; +- if (refLine[b1] < columns) { +- ++b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVertL2: +- if (a0 == 0 || refLine[b1] - 2 > a0New) { +- a0New = codingLine[++a0] = refLine[b1] - 2; +- --b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVertR3: +- a0New = codingLine[++a0] = refLine[b1] + 3; +- if (refLine[b1] < columns) { +- ++b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case twoDimVertL3: +- if (a0 == 0 || refLine[b1] - 3 > a0New) { +- a0New = codingLine[++a0] = refLine[b1] - 3; +- --b1; +- while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns) +- b1 += 2; +- } +- break; +- case EOF: +- eof = gTrue; +- codingLine[a0 = 0] = columns; +- return EOF; +- default: +- error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1); +- err = gTrue; +- break; +- } +- } while (codingLine[a0] < columns); +- +- // 1-D encoding +- } else { +- codingLine[a0 = 0] = 0; +- while (1) { +- code1 = 0; +- do { +- code1 += code3 = getWhiteCode(); +- } while (code3 >= 64); +- codingLine[a0+1] = codingLine[a0] + code1; +- ++a0; +- if (codingLine[a0] >= columns) +- break; +- code2 = 0; +- do { +- code2 += code3 = getBlackCode(); +- } while (code3 >= 64); +- codingLine[a0+1] = codingLine[a0] + code2; +- ++a0; +- if (codingLine[a0] >= columns) +- break; +- } ++inline void CCITTFaxStream::addPixels(int a1, int blackPixels) { ++ if (a1 > codingLine[a0i]) { ++ if (a1 > columns) { ++ error(getPos(), "CCITTFax row is wrong length (%d)", a1); ++ err = gTrue; ++ a1 = columns; + } ++ if ((a0i & 1) ^ blackPixels) { ++ ++a0i; ++ } ++ codingLine[a0i] = a1; ++ } ++} + +- if (codingLine[a0] != columns) { +- error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]); +- // force the row to be the correct length +- while (codingLine[a0] > columns) { +- --a0; +- } +- codingLine[++a0] = columns; ++inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) { ++ if (a1 > codingLine[a0i]) { ++ if (a1 > columns) { ++ error(getPos(), "CCITTFax row is wrong length (%d)", a1); + err = gTrue; ++ a1 = columns; + } +- +- // byte-align the row +- if (byteAlign) { +- inputBits &= ~7; ++ if ((a0i & 1) ^ blackPixels) { ++ ++a0i; + } +- +- // check for end-of-line marker, skipping over any extra zero bits +- gotEOL = gFalse; +- if (!endOfBlock && row == rows - 1) { +- eof = gTrue; +- } else { +- code1 = lookBits(12); +- while (code1 == 0) { +- eatBits(1); +- code1 = lookBits(12); +- } +- if (code1 == 0x001) { +- eatBits(12); +- gotEOL = gTrue; +- } else if (code1 == EOF) { +- eof = gTrue; +- } ++ codingLine[a0i] = a1; ++ } else if (a1 < codingLine[a0i]) { ++ if (a1 < 0) { ++ error(getPos(), "Invalid CCITTFax code"); ++ err = gTrue; ++ a1 = 0; + } +- +- // get 2D encoding tag +- if (!eof && encoding > 0) { +- nextLine2D = !lookBits(1); +- eatBits(1); +- } +- +- // check for end-of-block marker +- if (endOfBlock && gotEOL) { +- code1 = lookBits(12); +- if (code1 == 0x001) { +- eatBits(12); +- if (encoding > 0) { +- lookBits(1); +- eatBits(1); +- } +- if (encoding >= 0) { +- for (i = 0; i < 4; ++i) { +- code1 = lookBits(12); +- if (code1 != 0x001) { +- error(getPos(), "Bad RTC code in CCITTFax stream"); +- } +- eatBits(12); +- if (encoding > 0) { +- lookBits(1); +- eatBits(1); +- } +- } +- } +- eof = gTrue; +- } +- +- // look for an end-of-line marker after an error -- we only do +- // this if we know the stream contains end-of-line markers because +- // the "just plow on" technique tends to work better otherwise +- } else if (err && endOfLine) { +- do { +- if (code1 == EOF) { +- eof = gTrue; +- return EOF; +- } +- eatBits(1); +- code1 = lookBits(13); +- } while ((code1 >> 1) != 0x001); +- eatBits(12); +- if (encoding > 0) { +- eatBits(1); +- nextLine2D = !(code1 & 1); +- } ++ while (a0i > 0 && a1 <= codingLine[a0i - 1]) { ++ --a0i; + } ++ codingLine[a0i] = a1; ++ } ++} + +- a0 = 0; +- outputBits = codingLine[1] - codingLine[0]; +- if (outputBits == 0) { +- a0 = 1; +- outputBits = codingLine[2] - codingLine[1]; +- } ++int CCITTFaxStream::lookChar() { ++ short code1, code2, code3; ++ int b1i, blackPixels, i, bits; ++ GBool gotEOL; ++ ++ if (buf != EOF) { ++ return buf; ++ ++ // read the next row ++ if (outputBits == 0) { ++ ++ // if at eof just return EOF ++ if (eof) { ++ return EOF; ++ } ++ ++ err = gFalse; ++ ++ // 2-D encoding ++ if (nextLine2D) { ++ for (i = 0; codingLine[i] < columns; ++i) { ++ refLine[i] = codingLine[i]; ++ } ++ refLine[i++] = columns; ++ refLine[i] = columns; ++ codingLine[0] = 0; ++ a0i = 0; ++ b1i = 0; ++ blackPixels = 0; ++ // invariant: ++ // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] ++ // <= columns ++ // exception at left edge: ++ // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible ++ // exception at right edge: ++ // refLine[b1i] = refLine[b1i+1] = columns is possible ++ while (codingLine[a0i] < columns) { ++ code1 = getTwoDimCode(); ++ switch (code1) { ++ case twoDimPass: ++ addPixels(refLine[b1i + 1], blackPixels); ++ if (refLine[b1i + 1] < columns) { ++ b1i += 2; ++ } ++ break; ++ case twoDimHoriz: ++ code1 = code2 = 0; ++ if (blackPixels) { ++ do { ++ code1 += code3 = getBlackCode(); ++ } while (code3 >= 64); ++ do { ++ code2 += code3 = getWhiteCode(); ++ } while (code3 >= 64); ++ } else { ++ do { ++ code1 += code3 = getWhiteCode(); ++ } while (code3 >= 64); ++ do { ++ code2 += code3 = getBlackCode(); ++ } while (code3 >= 64); ++ } ++ addPixels(codingLine[a0i] + code1, blackPixels); ++ if (codingLine[a0i] < columns) { ++ addPixels(codingLine[a0i] + code2, blackPixels ^ 1); ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ break; ++ case twoDimVertR3: ++ addPixels(refLine[b1i] + 3, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertR2: ++ addPixels(refLine[b1i] + 2, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertR1: ++ addPixels(refLine[b1i] + 1, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVert0: ++ addPixels(refLine[b1i], blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertL3: ++ addPixelsNeg(refLine[b1i] - 3, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertL2: ++ addPixelsNeg(refLine[b1i] - 2, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertL1: ++ addPixelsNeg(refLine[b1i] - 1, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ } ++ break; ++ case EOF: ++ addPixels(columns, 0); ++ eof = gTrue; ++ break; ++ default: ++ error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1); ++ addPixels(columns, 0); ++ err = gTrue; ++ break; ++ } ++ } ++ ++ // 1-D encoding ++ } else { ++ codingLine[0] = 0; ++ a0i = 0; ++ blackPixels = 0; ++ while (codingLine[a0i] < columns) { ++ code1 = 0; ++ if (blackPixels) { ++ do { ++ code1 += code3 = getBlackCode(); ++ } while (code3 >= 64); ++ } else { ++ do { ++ code1 += code3 = getWhiteCode(); ++ } while (code3 >= 64); ++ } ++ ++ addPixels(codingLine[a0i] + code1, blackPixels); ++ blackPixels ^= 1; ++ } ++ } ++ ++ // byte-align the row ++ if (byteAlign) { ++ inputBits &= ~7; ++ } ++ ++ // check for end-of-line marker, skipping over any extra zero bits ++ gotEOL = gFalse; ++ if (!endOfBlock && row == rows - 1) { ++ eof = gTrue; ++ } else { ++ code1 = lookBits(12); ++ while (code1 == 0) { ++ eatBits(1); ++ code1 = lookBits(12); ++ } ++ if (code1 == 0x001) { ++ eatBits(12); ++ gotEOL = gTrue; ++ } else if (code1 == EOF) { ++ eof = gTrue; ++ } ++ } ++ ++ // get 2D encoding tag ++ if (!eof && encoding > 0) { ++ nextLine2D = !lookBits(1); ++ eatBits(1); ++ } ++ ++ // check for end-of-block marker ++ if (endOfBlock && gotEOL) { ++ code1 = lookBits(12); ++ if (code1 == 0x001) { ++ eatBits(12); ++ if (encoding > 0) { ++ lookBits(1); ++ eatBits(1); ++ } ++ if (encoding >= 0) { ++ for (i = 0; i < 4; ++i) { ++ code1 = lookBits(12); ++ if (code1 != 0x001) { ++ error(getPos(), "Bad RTC code in CCITTFax stream"); ++ } ++ eatBits(12); ++ if (encoding > 0) { ++ lookBits(1); ++ eatBits(1); ++ } ++ } ++ } ++ eof = gTrue; ++ } ++ ++ // look for an end-of-line marker after an error -- we only do ++ // this if we know the stream contains end-of-line markers because ++ // the "just plow on" technique tends to work better otherwise ++ } else if (err && endOfLine) { ++ while (1) { ++ code1 = lookBits(13); ++ if (code1 == EOF) { ++ eof = gTrue; ++ return EOF; ++ } ++ if ((code1 >> 1) == 0x001) { ++ break; ++ } ++ eatBits(1); ++ } ++ eatBits(12); ++ if (encoding > 0) { ++ eatBits(1); ++ nextLine2D = !(code1 & 1); ++ } ++ } ++ ++ // set up for output ++ if (codingLine[0] > 0) { ++ outputBits = codingLine[a0i = 0]; ++ } else { ++ outputBits = codingLine[a0i = 1]; ++ } + +- ++row; +- } ++ ++row; ++ } + +- // get a byte +- if (outputBits >= 8) { +- ret = ((a0 & 1) == 0) ? 0xff : 0x00; +- if ((outputBits -= 8) == 0) { +- ++a0; +- if (codingLine[a0] < columns) { +- outputBits = codingLine[a0 + 1] - codingLine[a0]; +- } +- } +- } else { +- bits = 8; +- ret = 0; +- do { +- if (outputBits > bits) { +- i = bits; +- bits = 0; +- if ((a0 & 1) == 0) { +- ret |= 0xff >> (8 - i); +- } +- outputBits -= i; +- } else { +- i = outputBits; +- bits -= outputBits; +- if ((a0 & 1) == 0) { +- ret |= (0xff >> (8 - i)) << bits; +- } +- outputBits = 0; +- ++a0; +- if (codingLine[a0] < columns) { +- outputBits = codingLine[a0 + 1] - codingLine[a0]; ++ // get a byte ++ if (outputBits >= 8) { ++ buf = (a0i & 1) ? 0x00 : 0xff; ++ outputBits -= 8; ++ if (outputBits == 0 && codingLine[a0i] < columns) { ++ ++a0i; ++ outputBits = codingLine[a0i] - codingLine[a0i - 1]; ++ } ++ } else { ++ bits = 8; ++ buf = 0; ++ do { ++ if (outputBits > bits) { ++ buf <<= bits; ++ if (!(a0i & 1)) { ++ buf |= 0xff >> (8 - bits); ++ } ++ outputBits -= bits; ++ bits = 0; ++ } else { ++ buf <<= outputBits; ++ if (!(a0i & 1)) { ++ buf |= 0xff >> (8 - outputBits); ++ } ++ bits -= outputBits; ++ outputBits = 0; ++ if (codingLine[a0i] < columns) { ++ ++a0i; ++ outputBits = codingLine[a0i] - codingLine[a0i - 1]; ++ } else if (bits > 0) { ++ buf <<= bits; ++ bits = 0; ++ } ++ } ++ } while (bits); ++ } ++ if (black) { ++ buf ^= 0xff; ++ } ++ return buf; + } +- } +- } while (bits > 0 && codingLine[a0] < columns); +- } +- buf = black ? (ret ^ 0xff) : ret; +- return buf; + } + + short CCITTFaxStream::getTwoDimCode() { +@@ -1646,6 +1722,9 @@ + code = 0; // make gcc happy + if (endOfBlock) { + code = lookBits(12); ++ if (code == EOF) { ++ return 1; ++ } + if ((code >> 5) == 0) { + p = &whiteTab1[code]; + } else { +@@ -1658,6 +1737,9 @@ + } else { + for (n = 1; n <= 9; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 9) { + code <<= 9 - n; + } +@@ -1669,6 +1751,9 @@ + } + for (n = 11; n <= 12; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 12) { + code <<= 12 - n; + } +@@ -1694,9 +1779,12 @@ + code = 0; // make gcc happy + if (endOfBlock) { + code = lookBits(13); ++ if (code == EOF) { ++ return 1; ++ } + if ((code >> 7) == 0) { + p = &blackTab1[code]; +- } else if ((code >> 9) == 0) { ++ } else if ((code >> 9) == 0 && (code >> 7) != 0) { + p = &blackTab2[(code >> 1) - 64]; + } else { + p = &blackTab3[code >> 7]; +@@ -1708,6 +1796,9 @@ + } else { + for (n = 2; n <= 6; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 6) { + code <<= 6 - n; + } +@@ -1719,6 +1810,9 @@ + } + for (n = 7; n <= 12; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 12) { + code <<= 12 - n; + } +@@ -1732,6 +1826,9 @@ + } + for (n = 10; n <= 13; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 13) { + code <<= 13 - n; + } +@@ -1954,6 +2051,12 @@ + // allocate a buffer for the whole image + bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; + bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight; ++ if (bufWidth <= 0 || bufHeight <= 0 || ++ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { ++ error(getPos(), "Invalid image size in DCT stream"); ++ y = height; ++ return; ++ } + for (i = 0; i < numComps; ++i) { + frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int)); + memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int)); +@@ -3015,6 +3118,11 @@ + } + scanInfo.firstCoeff = str->getChar(); + scanInfo.lastCoeff = str->getChar(); ++ if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 || ++ scanInfo.firstCoeff > scanInfo.lastCoeff) { ++ error(getPos(), "Bad DCT coefficient numbers in scan info block"); ++ return gFalse; ++ } + c = str->getChar(); + scanInfo.ah = (c >> 4) & 0x0f; + scanInfo.al = c & 0x0f; +diff -aur cups-1.3.4/pdftops/Stream.h fw_cups-1.3.4/pdftops/Stream.h +--- cups-1.3.4/pdftops/Stream.h 2006-02-13 04:08:11.000000000 +0100 ++++ fw_cups-1.3.4/pdftops/Stream.h 2007-11-23 08:50:16.000000000 +0100 +@@ -519,13 +519,15 @@ + int row; // current row + int inputBuf; // input buffer + int inputBits; // number of bits in input buffer +- short *refLine; // reference line changing elements +- int b1; // index into refLine +- short *codingLine; // coding line changing elements +- int a0; // index into codingLine ++ int *codingLine; // coding line changing elements ++ int *refLine; // reference line changing elements ++ int a0i; // index into codingLine ++ GBool err; // error on current line + int outputBits; // remaining ouput bits + int buf; // character buffer + ++ void addPixels(int a1, int black); ++ void addPixelsNeg(int a1, int black); + short getTwoDimCode(); + short getWhiteCode(); + short getBlackCode(); _______________________________________________ Frugalware-git mailing list Frugalware-git@frugalware.org http://frugalware.org/mailman/listinfo/frugalware-git
