1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
--- kpdf/xpdf/Gfx.cc 28 Sep 2003 12:17:12 -0000 1.4
+++ kpdf/xpdf/Gfx.cc 22 Dec 2004 12:04:49 -0000
@@ -2379,11 +2379,13 @@ void Gfx::doImage(Object *ref, Stream *s
// get the mask
haveMask = gFalse;
dict->lookup("Mask", &maskObj);
if (maskObj.isArray()) {
- for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+ for (i = 0;
+ i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+ ++i) {
maskObj.arrayGet(i, &obj1);
maskColors[i] = obj1.getInt();
obj1.free();
}
haveMask = gTrue;
--- kpdf/xpdf/GfxState.cc 20 Aug 2003 21:25:12 -0000 1.3
+++ kpdf/xpdf/GfxState.cc 22 Dec 2004 12:04:49 -0000
@@ -706,10 +706,15 @@ GfxColorSpace *GfxICCBasedColorSpace::pa
obj1.free();
return NULL;
}
nCompsA = obj2.getInt();
obj2.free();
+ if (nCompsA > gfxColorMaxComps) {
+ error(-1, "ICCBased color space with too many (%d > %d) components",
+ nCompsA, gfxColorMaxComps);
+ nCompsA = gfxColorMaxComps;
+ }
if (dict->lookup("Alternate", &obj2)->isNull() ||
!(altA = GfxColorSpace::parse(&obj2))) {
switch (nCompsA) {
case 1:
altA = new GfxDeviceGrayColorSpace();
@@ -1045,10 +1050,15 @@ GfxColorSpace *GfxDeviceNColorSpace::par
if (!arr->get(1, &obj1)->isArray()) {
error(-1, "Bad DeviceN color space (names)");
goto err2;
}
nCompsA = obj1.arrayGetLength();
+ if (nCompsA > gfxColorMaxComps) {
+ error(-1, "DeviceN color space with too many (%d > %d) components",
+ nCompsA, gfxColorMaxComps);
+ nCompsA = gfxColorMaxComps;
+ }
for (i = 0; i < nCompsA; ++i) {
if (!obj1.arrayGet(i, &obj2)->isName()) {
error(-1, "Bad DeviceN color space (names)");
obj2.free();
goto err2;
|
GitWeb
