poppler/GfxState.cc | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
New commits: commit 44cd46a6e04a87bd702dab4a662042f69f16c4ad Author: Albert Astals Cid <[email protected]> Date: Mon Apr 23 20:02:55 2012 +0200 Do not try to access nPatches - 1 if nPatches is 0 Found by Mateusz "j00ru" Jurczyk and Gynvael Coldwind diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc index 75c87e9..2fb61eb 100644 --- a/poppler/GfxState.cc +++ b/poppler/GfxState.cc @@ -16,7 +16,7 @@ // Copyright (C) 2005 Kristian Høgsberg <[email protected]> // Copyright (C) 2006, 2007 Jeff Muizelaar <[email protected]> // Copyright (C) 2006, 2010 Carlos Garcia Campos <[email protected]> -// Copyright (C) 2006-2011 Albert Astals Cid <[email protected]> +// Copyright (C) 2006-2012 Albert Astals Cid <[email protected]> // Copyright (C) 2009, 2012 Koji Otani <[email protected]> // Copyright (C) 2009, 2011 Thomas Freitag <[email protected]> // Copyright (C) 2009 Christian Persch <[email protected]> @@ -4464,6 +4464,9 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(int typeA, Dict *dict, } break; case 1: + if (nPatchesA == 0) { + goto err1; + } p->x[0][0] = patchesA[nPatchesA-1].x[0][3]; p->y[0][0] = patchesA[nPatchesA-1].y[0][3]; p->x[0][1] = patchesA[nPatchesA-1].x[1][3]; @@ -4496,6 +4499,9 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(int typeA, Dict *dict, } break; case 2: + if (nPatchesA == 0) { + goto err1; + } p->x[0][0] = patchesA[nPatchesA-1].x[3][3]; p->y[0][0] = patchesA[nPatchesA-1].y[3][3]; p->x[0][1] = patchesA[nPatchesA-1].x[3][2]; @@ -4528,6 +4534,9 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(int typeA, Dict *dict, } break; case 3: + if (nPatchesA == 0) { + goto err1; + } p->x[0][0] = patchesA[nPatchesA-1].x[3][0]; p->y[0][0] = patchesA[nPatchesA-1].y[3][0]; p->x[0][1] = patchesA[nPatchesA-1].x[2][0]; @@ -4603,6 +4612,9 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(int typeA, Dict *dict, } break; case 1: + if (nPatchesA == 0) { + goto err1; + } p->x[0][0] = patchesA[nPatchesA-1].x[0][3]; p->y[0][0] = patchesA[nPatchesA-1].y[0][3]; p->x[0][1] = patchesA[nPatchesA-1].x[1][3]; @@ -4643,6 +4655,9 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(int typeA, Dict *dict, } break; case 2: + if (nPatchesA == 0) { + goto err1; + } p->x[0][0] = patchesA[nPatchesA-1].x[3][3]; p->y[0][0] = patchesA[nPatchesA-1].y[3][3]; p->x[0][1] = patchesA[nPatchesA-1].x[3][2]; @@ -4683,6 +4698,9 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(int typeA, Dict *dict, } break; case 3: + if (nPatchesA == 0) { + goto err1; + } p->x[0][0] = patchesA[nPatchesA-1].x[3][0]; p->y[0][0] = patchesA[nPatchesA-1].y[3][0]; p->x[0][1] = patchesA[nPatchesA-1].x[2][0];
_______________________________________________ poppler mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/poppler
