poppler/Stream.cc | 10 ++++++---- splash/SplashBitmap.cc | 3 ++- 2 files changed, 8 insertions(+), 5 deletions(-)
New commits: commit 9e36206465289c96cb189c648a6f5121714c647b Author: Albert Astals Cid <[email protected]> Date: Sun Apr 29 22:18:12 2012 +0200 include for memcpy diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc index 6d37434..f252318 100644 --- a/splash/SplashBitmap.cc +++ b/splash/SplashBitmap.cc @@ -11,7 +11,7 @@ // All changes made under the Poppler project to this file are licensed // under GPL version 2 or later // -// Copyright (C) 2006, 2009, 2010 Albert Astals Cid <[email protected]> +// Copyright (C) 2006, 2009, 2010, 2012 Albert Astals Cid <[email protected]> // Copyright (C) 2007 Ilmari Heikkinen <[email protected]> // Copyright (C) 2009 Shen Liang <[email protected]> // Copyright (C) 2009 Stefan Thomas <[email protected]> @@ -33,6 +33,7 @@ #endif #include <stdio.h> +#include <string.h> #include <stdlib.h> #include <limits.h> #include "goo/gmem.h" commit 931051fe0bb445545355027d999515bc3d4b32ef Author: Albert Astals Cid <[email protected]> Date: Sun Apr 29 22:07:34 2012 +0200 Make sure the index for refLine is in bounds Found in a fuzzed pdf sent by Mateusz "j00ru" Jurczyk and Gynvael Coldwind diff --git a/poppler/Stream.cc b/poppler/Stream.cc index 8bb12bd..423bf1c 100644 --- a/poppler/Stream.cc +++ b/poppler/Stream.cc @@ -14,7 +14,7 @@ // under GPL version 2 or later // // Copyright (C) 2005 Jeff Muizelaar <[email protected]> -// Copyright (C) 2006-2010 Albert Astals Cid <[email protected]> +// Copyright (C) 2006-2010, 2012 Albert Astals Cid <[email protected]> // Copyright (C) 2007 Krzysztof Kowalczyk <[email protected]> // Copyright (C) 2008 Julien Rebetez <[email protected]> // Copyright (C) 2009 Carlos Garcia Campos <[email protected]> @@ -1727,9 +1727,11 @@ int CCITTFaxStream::lookChar() { code1 = getTwoDimCode(); switch (code1) { case twoDimPass: - addPixels(refLine[b1i + 1], blackPixels); - if (refLine[b1i + 1] < columns) { - b1i += 2; + if (likely(b1i + 1 < columns + 2)) { + addPixels(refLine[b1i + 1], blackPixels); + if (refLine[b1i + 1] < columns) { + b1i += 2; + } } break; case twoDimHoriz: _______________________________________________ poppler mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/poppler
