xpdf/patches/xpdf-3.02pl2.patch

diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.cc xpdf-3.02/xpdf/Stream.cc
*** xpdf-3.02pl1.orig/xpdf/Stream.cc	Thu Oct 25 15:47:38 2007
--- xpdf-3.02/xpdf/Stream.cc	Thu Oct 25 15:48:19 2007
***************
*** 1243,1265 ****
    columns = columnsA;
    if (columns < 1) {
      columns = 1;
!   }
!   if (columns + 4 <= 0) {
!     columns = INT_MAX - 4;
    }
    rows = rowsA;
    endOfBlock = endOfBlockA;
    black = blackA;
!   refLine = (short *)gmallocn(columns + 3, sizeof(short));
!   codingLine = (short *)gmallocn(columns + 2, sizeof(short));
  
    eof = gFalse;
    row = 0;
    nextLine2D = encoding < 0;
    inputBits = 0;
!   codingLine[0] = 0;
!   codingLine[1] = refLine[2] = columns;
!   a0 = 1;
  
    buf = EOF;
  }
--- 1243,1268 ----
    columns = columnsA;
    if (columns < 1) {
      columns = 1;
!   } else if (columns > INT_MAX - 2) {
!     columns = INT_MAX - 2;
    }
    rows = rowsA;
    endOfBlock = endOfBlockA;
    black = blackA;
!   // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
!   // ---> max codingLine size = columns + 1
!   // refLine has one extra guard entry at the end
!   // ---> max refLine size = columns + 2
!   codingLine = (int *)gmallocn(columns + 1, sizeof(int));
!   refLine = (int *)gmallocn(columns + 2, sizeof(int));
  
    eof = gFalse;
    row = 0;
    nextLine2D = encoding < 0;
    inputBits = 0;
!   codingLine[0] = columns;
!   a0i = 0;
!   outputBits = 0;
  
    buf = EOF;
  }
***************
*** 1278,1286 ****
    row = 0;
    nextLine2D = encoding < 0;
    inputBits = 0;
!   codingLine[0] = 0;
!   codingLine[1] = columns;
!   a0 = 1;
    buf = EOF;
  
    // skip any initial zero bits and end-of-line marker, and get the 2D
--- 1281,1289 ----
    row = 0;
    nextLine2D = encoding < 0;
    inputBits = 0;
!   codingLine[0] = columns;
!   a0i = 0;
!   outputBits = 0;
    buf = EOF;
  
    // skip any initial zero bits and end-of-line marker, and get the 2D
***************
*** 1297,1507 ****
    }
  }
  
  int CCITTFaxStream::lookChar() {
    short code1, code2, code3;
!   int a0New;
!   GBool err, gotEOL;
!   int ret;
!   int bits, i;
  
!   // if at eof just return EOF
!   if (eof && codingLine[a0] >= columns) {
!     return EOF;
    }
  
    // read the next row
!   err = gFalse;
!   if (codingLine[a0] >= columns) {
  
      // 2-D encoding
      if (nextLine2D) {
-       // state:
-       //   a0New = current position in coding line (0 <= a0New <= columns)
-       //   codingLine[a0] = last change in coding line
-       //                    (black-to-white if a0 is even,
-       //                     white-to-black if a0 is odd)
-       //   refLine[b1] = next change in reference line of opposite color
-       //                 to a0
-       // invariants:
-       //   0 <= codingLine[a0] <= a0New
-       //           <= refLine[b1] <= refLine[b1+1] <= columns
-       //   0 <= a0 <= columns+1
-       //   refLine[0] = 0
-       //   refLine[n] = refLine[n+1] = columns
-       //     -- for some 1 <= n <= columns+1
-       // end condition:
-       //   0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
-       //     < codingLine[n-1] < codingLine[n] = columns
-       //     -- where 1 <= n <= columns+1
        for (i = 0; codingLine[i] < columns; ++i) {
  	refLine[i] = codingLine[i];
        }
!       refLine[i] = refLine[i + 1] = columns;
!       b1 = 1;
!       a0New = codingLine[a0 = 0] = 0;
!       do {
  	code1 = getTwoDimCode();
  	switch (code1) {
  	case twoDimPass:
! 	  if (refLine[b1] < columns) {
! 	    a0New = refLine[b1 + 1];
! 	    b1 += 2;
  	  }
  	  break;
  	case twoDimHoriz:
! 	  if ((a0 & 1) == 0) {
! 	    code1 = code2 = 0;
  	    do {
! 	      code1 += code3 = getWhiteCode();
  	    } while (code3 >= 64);
  	    do {
! 	      code2 += code3 = getBlackCode();
  	    } while (code3 >= 64);
  	  } else {
- 	    code1 = code2 = 0;
  	    do {
! 	      code1 += code3 = getBlackCode();
  	    } while (code3 >= 64);
  	    do {
! 	      code2 += code3 = getWhiteCode();
  	    } while (code3 >= 64);
  	  }
! 	  if (code1 > 0 || code2 > 0) {
! 	    if (a0New + code1 <= columns) {
! 	      codingLine[a0 + 1] = a0New + code1;
! 	    } else {
! 	      codingLine[a0 + 1] = columns;
! 	    }
! 	    ++a0;
! 	    if (codingLine[a0] + code2 <= columns) {
! 	      codingLine[a0 + 1] = codingLine[a0] + code2;
! 	    } else {
! 	      codingLine[a0 + 1] = columns;
! 	    }
! 	    ++a0;
! 	    a0New = codingLine[a0];
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
  	  }
  	  break;
! 	case twoDimVert0:
! 	  if (refLine[b1] < columns) {
! 	    a0New = codingLine[++a0] = refLine[b1];
! 	    ++b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
- 	  } else {
- 	    a0New = codingLine[++a0] = columns;
  	  }
  	  break;
  	case twoDimVertR1:
! 	  if (refLine[b1] + 1 < columns) {
! 	    a0New = codingLine[++a0] = refLine[b1] + 1;
! 	    ++b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
- 	  } else {
- 	    a0New = codingLine[++a0] = columns;
  	  }
  	  break;
! 	case twoDimVertL1:
! 	  if (refLine[b1] - 1 > a0New || (a0 == 0 && refLine[b1] == 1)) {
! 	    a0New = codingLine[++a0] = refLine[b1] - 1;
! 	    --b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
  	  }
  	  break;
! 	case twoDimVertR2:
! 	  if (refLine[b1] + 2 < columns) {
! 	    a0New = codingLine[++a0] = refLine[b1] + 2;
! 	    ++b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
- 	  } else {
- 	    a0New = codingLine[++a0] = columns;
  	  }
  	  break;
  	case twoDimVertL2:
! 	  if (refLine[b1] - 2 > a0New || (a0 == 0 && refLine[b1] == 2)) {
! 	    a0New = codingLine[++a0] = refLine[b1] - 2;
! 	    --b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
! 	  }
! 	  break;
! 	case twoDimVertR3:
! 	  if (refLine[b1] + 3 < columns) {
! 	    a0New = codingLine[++a0] = refLine[b1] + 3;
! 	    ++b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
- 	  } else {
- 	    a0New = codingLine[++a0] = columns;
  	  }
  	  break;
! 	case twoDimVertL3:
! 	  if (refLine[b1] - 3 > a0New || (a0 == 0 && refLine[b1] == 3)) {
! 	    a0New = codingLine[++a0] = refLine[b1] - 3;
! 	    --b1;
! 	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
! 	      b1 += 2;
  	    }
  	  }
  	  break;
  	case EOF:
  	  eof = gTrue;
! 	  codingLine[a0 = 0] = columns;
! 	  return EOF;
  	default:
  	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
  	  err = gTrue;
  	  break;
  	}
!       } while (codingLine[a0] < columns);
  
      // 1-D encoding
      } else {
!       codingLine[a0 = 0] = 0;
!       while (1) {
  	code1 = 0;
! 	do {
! 	  code1 += code3 = getWhiteCode();
! 	} while (code3 >= 64);
! 	codingLine[a0+1] = codingLine[a0] + code1;
! 	++a0;
! 	if (codingLine[a0] >= columns) {
! 	  break;
! 	}
! 	code2 = 0;
! 	do {
! 	  code2 += code3 = getBlackCode();
! 	} while (code3 >= 64);
! 	codingLine[a0+1] = codingLine[a0] + code2;
! 	++a0;
! 	if (codingLine[a0] >= columns) {
! 	  break;
  	}
        }
      }
  
-     if (codingLine[a0] != columns) {
-       error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
-       // force the row to be the correct length
-       while (codingLine[a0] > columns) {
- 	--a0;
-       }
-       codingLine[++a0] = columns;
-       err = gTrue;
-     }
- 
      // byte-align the row
      if (byteAlign) {
        inputBits &= ~7;
--- 1300,1529 ----
    }
  }
  
+ inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
+   if (a1 > codingLine[a0i]) {
+     if (a1 > columns) {
+       error(getPos(), "CCITTFax row is wrong length (%d)", a1);
+       err = gTrue;
+       a1 = columns;
+     }
+     if ((a0i & 1) ^ blackPixels) {
+       ++a0i;
+     }
+     codingLine[a0i] = a1;
+   }
+ }
+ 
+ inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
+   if (a1 > codingLine[a0i]) {
+     if (a1 > columns) {
+       error(getPos(), "CCITTFax row is wrong length (%d)", a1);
+       err = gTrue;
+       a1 = columns;
+     }
+     if ((a0i & 1) ^ blackPixels) {
+       ++a0i;
+     }
+     codingLine[a0i] = a1;
+   } else if (a1 < codingLine[a0i]) {
+     if (a1 < 0) {
+       error(getPos(), "Invalid CCITTFax code");
+       err = gTrue;
+       a1 = 0;
+     }
+     while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
+       --a0i;
+     }
+     codingLine[a0i] = a1;
+   }
+ }
+ 
  int CCITTFaxStream::lookChar() {
    short code1, code2, code3;
!   int b1i, blackPixels, i, bits;
!   GBool gotEOL;
  
!   if (buf != EOF) {
!     return buf;
    }
  
    // read the next row
!   if (outputBits == 0) {
! 
!     // if at eof just return EOF
!     if (eof) {
!       return EOF;
!     }
! 
!     err = gFalse;
  
      // 2-D encoding
      if (nextLine2D) {
        for (i = 0; codingLine[i] < columns; ++i) {
  	refLine[i] = codingLine[i];
        }
!       refLine[i++] = columns;
!       refLine[i] = columns;
!       codingLine[0] = 0;
!       a0i = 0;
!       b1i = 0;
!       blackPixels = 0;
!       // invariant:
!       // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
!       //                                                             <= columns
!       // exception at left edge:
!       //   codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
!       // exception at right edge:
!       //   refLine[b1i] = refLine[b1i+1] = columns is possible
!       while (codingLine[a0i] < columns) {
  	code1 = getTwoDimCode();
  	switch (code1) {
  	case twoDimPass:
! 	  addPixels(refLine[b1i + 1], blackPixels);
! 	  if (refLine[b1i + 1] < columns) {
! 	    b1i += 2;
  	  }
  	  break;
  	case twoDimHoriz:
! 	  code1 = code2 = 0;
! 	  if (blackPixels) {
  	    do {
! 	      code1 += code3 = getBlackCode();
  	    } while (code3 >= 64);
  	    do {
! 	      code2 += code3 = getWhiteCode();
  	    } while (code3 >= 64);
  	  } else {
  	    do {
! 	      code1 += code3 = getWhiteCode();
  	    } while (code3 >= 64);
  	    do {
! 	      code2 += code3 = getBlackCode();
  	    } while (code3 >= 64);
  	  }
! 	  addPixels(codingLine[a0i] + code1, blackPixels);
! 	  if (codingLine[a0i] < columns) {
! 	    addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
! 	  }
! 	  while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	    b1i += 2;
! 	  }
! 	  break;
! 	case twoDimVertR3:
! 	  addPixels(refLine[b1i] + 3, blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    ++b1i;
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
! 	case twoDimVertR2:
! 	  addPixels(refLine[b1i] + 2, blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    ++b1i;
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
  	case twoDimVertR1:
! 	  addPixels(refLine[b1i] + 1, blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    ++b1i;
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
! 	case twoDimVert0:
! 	  addPixels(refLine[b1i], blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    ++b1i;
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
! 	case twoDimVertL3:
! 	  addPixelsNeg(refLine[b1i] - 3, blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    if (b1i > 0) {
! 	      --b1i;
! 	    } else {
! 	      ++b1i;
! 	    }
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
  	case twoDimVertL2:
! 	  addPixelsNeg(refLine[b1i] - 2, blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    if (b1i > 0) {
! 	      --b1i;
! 	    } else {
! 	      ++b1i;
  	    }
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
! 	case twoDimVertL1:
! 	  addPixelsNeg(refLine[b1i] - 1, blackPixels);
! 	  blackPixels ^= 1;
! 	  if (codingLine[a0i] < columns) {
! 	    if (b1i > 0) {
! 	      --b1i;
! 	    } else {
! 	      ++b1i;
! 	    }
! 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! 	      b1i += 2;
  	    }
  	  }
  	  break;
  	case EOF:
+ 	  addPixels(columns, 0);
  	  eof = gTrue;
! 	  break;
  	default:
  	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
+ 	  addPixels(columns, 0);
  	  err = gTrue;
  	  break;
  	}
!       }
  
      // 1-D encoding
      } else {
!       codingLine[0] = 0;
!       a0i = 0;
!       blackPixels = 0;
!       while (codingLine[a0i] < columns) {
  	code1 = 0;
! 	if (blackPixels) {
! 	  do {
! 	    code1 += code3 = getBlackCode();
! 	  } while (code3 >= 64);
! 	} else {
! 	  do {
! 	    code1 += code3 = getWhiteCode();
! 	  } while (code3 >= 64);
  	}
+ 	addPixels(codingLine[a0i] + code1, blackPixels);
+ 	blackPixels ^= 1;
        }
      }
  
      // byte-align the row
      if (byteAlign) {
        inputBits &= ~7;
***************
*** 1560,1573 ****
      // this if we know the stream contains end-of-line markers because
      // the "just plow on" technique tends to work better otherwise
      } else if (err && endOfLine) {
!       do {
  	if (code1 == EOF) {
  	  eof = gTrue;
  	  return EOF;
  	}
  	eatBits(1);
! 	code1 = lookBits(13);
!       } while ((code1 >> 1) != 0x001);
        eatBits(12); 
        if (encoding > 0) {
  	eatBits(1);
--- 1582,1598 ----
      // this if we know the stream contains end-of-line markers because
      // the "just plow on" technique tends to work better otherwise
      } else if (err && endOfLine) {
!       while (1) {
! 	code1 = lookBits(13);
  	if (code1 == EOF) {
  	  eof = gTrue;
  	  return EOF;
  	}
+ 	if ((code1 >> 1) == 0x001) {
+ 	  break;
+ 	}
  	eatBits(1);
!       }
        eatBits(12); 
        if (encoding > 0) {
  	eatBits(1);
***************
*** 1575,1585 ****
        }
      }
  
!     a0 = 0;
!     outputBits = codingLine[1] - codingLine[0];
!     if (outputBits == 0) {
!       a0 = 1;
!       outputBits = codingLine[2] - codingLine[1];
      }
  
      ++row;
--- 1600,1610 ----
        }
      }
  
!     // set up for output
!     if (codingLine[0] > 0) {
!       outputBits = codingLine[a0i = 0];
!     } else {
!       outputBits = codingLine[a0i = 1];
      }
  
      ++row;
***************
*** 1587,1625 ****
  
    // get a byte
    if (outputBits >= 8) {
!     ret = ((a0 & 1) == 0) ? 0xff : 0x00;
!     if ((outputBits -= 8) == 0) {
!       ++a0;
!       if (codingLine[a0] < columns) {
! 	outputBits = codingLine[a0 + 1] - codingLine[a0];
!       }
      }
    } else {
      bits = 8;
!     ret = 0;
      do {
        if (outputBits > bits) {
! 	i = bits;
! 	bits = 0;
! 	if ((a0 & 1) == 0) {
! 	  ret |= 0xff >> (8 - i);
  	}
! 	outputBits -= i;
        } else {
! 	i = outputBits;
! 	bits -= outputBits;
! 	if ((a0 & 1) == 0) {
! 	  ret |= (0xff >> (8 - i)) << bits;
  	}
  	outputBits = 0;
! 	++a0;
! 	if (codingLine[a0] < columns) {
! 	  outputBits = codingLine[a0 + 1] - codingLine[a0];
  	}
        }
!     } while (bits > 0 && codingLine[a0] < columns);
    }
-   buf = black ? (ret ^ 0xff) : ret;
    return buf;
  }
  
--- 1612,1654 ----
  
    // get a byte
    if (outputBits >= 8) {
!     buf = (a0i & 1) ? 0x00 : 0xff;
!     outputBits -= 8;
!     if (outputBits == 0 && codingLine[a0i] < columns) {
!       ++a0i;
!       outputBits = codingLine[a0i] - codingLine[a0i - 1];
      }
    } else {
      bits = 8;
!     buf = 0;
      do {
        if (outputBits > bits) {
! 	buf <<= bits;
! 	if (!(a0i & 1)) {
! 	  buf |= 0xff >> (8 - bits);
  	}
! 	outputBits -= bits;
! 	bits = 0;
        } else {
! 	buf <<= outputBits;
! 	if (!(a0i & 1)) {
! 	  buf |= 0xff >> (8 - outputBits);
  	}
+ 	bits -= outputBits;
  	outputBits = 0;
! 	if (codingLine[a0i] < columns) {
! 	  ++a0i;
! 	  outputBits = codingLine[a0i] - codingLine[a0i - 1];
! 	} else if (bits > 0) {
! 	  buf <<= bits;
! 	  bits = 0;
  	}
        }
!     } while (bits);
!   }
!   if (black) {
!     buf ^= 0xff;
    }
    return buf;
  }
  
***************
*** 1661,1666 ****
--- 1690,1698 ----
    code = 0; // make gcc happy
    if (endOfBlock) {
      code = lookBits(12);
+     if (code == EOF) {
+       return 1;
+     }
      if ((code >> 5) == 0) {
        p = &whiteTab1[code];
      } else {
***************
*** 1673,1678 ****
--- 1705,1713 ----
    } else {
      for (n = 1; n <= 9; ++n) {
        code = lookBits(n);
+       if (code == EOF) {
+ 	return 1;
+       }
        if (n < 9) {
  	code <<= 9 - n;
        }
***************
*** 1684,1689 ****
--- 1719,1727 ----
      }
      for (n = 11; n <= 12; ++n) {
        code = lookBits(n);
+       if (code == EOF) {
+ 	return 1;
+       }
        if (n < 12) {
  	code <<= 12 - n;
        }
***************
*** 1709,1717 ****
    code = 0; // make gcc happy
    if (endOfBlock) {
      code = lookBits(13);
      if ((code >> 7) == 0) {
        p = &blackTab1[code];
!     } else if ((code >> 9) == 0) {
        p = &blackTab2[(code >> 1) - 64];
      } else {
        p = &blackTab3[code >> 7];
--- 1747,1758 ----
    code = 0; // make gcc happy
    if (endOfBlock) {
      code = lookBits(13);
+     if (code == EOF) {
+       return 1;
+     }
      if ((code >> 7) == 0) {
        p = &blackTab1[code];
!     } else if ((code >> 9) == 0 && (code >> 7) != 0) {
        p = &blackTab2[(code >> 1) - 64];
      } else {
        p = &blackTab3[code >> 7];
***************
*** 1723,1728 ****
--- 1764,1772 ----
    } else {
      for (n = 2; n <= 6; ++n) {
        code = lookBits(n);
+       if (code == EOF) {
+ 	return 1;
+       }
        if (n < 6) {
  	code <<= 6 - n;
        }
***************
*** 1734,1739 ****
--- 1778,1786 ----
      }
      for (n = 7; n <= 12; ++n) {
        code = lookBits(n);
+       if (code == EOF) {
+ 	return 1;
+       }
        if (n < 12) {
  	code <<= 12 - n;
        }
***************
*** 1747,1752 ****
--- 1794,1802 ----
      }
      for (n = 10; n <= 13; ++n) {
        code = lookBits(n);
+       if (code == EOF) {
+ 	return 1;
+       }
        if (n < 13) {
  	code <<= 13 - n;
        }
***************
*** 1961,1966 ****
--- 2011,2022 ----
      // allocate a buffer for the whole image
      bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
      bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
+     if (bufWidth <= 0 || bufHeight <= 0 ||
+ 	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
+       error(getPos(), "Invalid image size in DCT stream");
+       y = height;
+       return;
+     }
      for (i = 0; i < numComps; ++i) {
        frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
        memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
***************
*** 3036,3041 ****
--- 3092,3102 ----
    }
    scanInfo.firstCoeff = str->getChar();
    scanInfo.lastCoeff = str->getChar();
+   if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
+       scanInfo.firstCoeff > scanInfo.lastCoeff) {
+     error(getPos(), "Bad DCT coefficient numbers in scan info block");
+     return gFalse;
+   }
    c = str->getChar();
    scanInfo.ah = (c >> 4) & 0x0f;
    scanInfo.al = c & 0x0f;
diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.h xpdf-3.02/xpdf/Stream.h
*** xpdf-3.02pl1.orig/xpdf/Stream.h	Tue Feb 27 14:05:52 2007
--- xpdf-3.02/xpdf/Stream.h	Thu Oct 25 15:48:15 2007
***************
*** 528,540 ****
    int row;			// current row
    int inputBuf;			// input buffer
    int inputBits;		// number of bits in input buffer
!   short *refLine;		// reference line changing elements
!   int b1;			// index into refLine
!   short *codingLine;		// coding line changing elements
!   int a0;			// index into codingLine
    int outputBits;		// remaining ouput bits
    int buf;			// character buffer
  
    short getTwoDimCode();
    short getWhiteCode();
    short getBlackCode();
--- 528,542 ----
    int row;			// current row
    int inputBuf;			// input buffer
    int inputBits;		// number of bits in input buffer
!   int *codingLine;		// coding line changing elements
!   int *refLine;			// reference line changing elements
!   int a0i;			// index into codingLine
!   GBool err;			// error on current line
    int outputBits;		// remaining ouput bits
    int buf;			// character buffer
  
+   void addPixels(int a1, int black);
+   void addPixelsNeg(int a1, int black);
    short getTwoDimCode();
    short getWhiteCode();
    short getBlackCode();
1	niro	521	diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.cc xpdf-3.02/xpdf/Stream.cc
2			*** xpdf-3.02pl1.orig/xpdf/Stream.cc Thu Oct 25 15:47:38 2007
3			--- xpdf-3.02/xpdf/Stream.cc Thu Oct 25 15:48:19 2007
4			***************
5			* 1243,1265 **
6			columns = columnsA;
7			if (columns < 1) {
8			columns = 1;
9			! }
10			! if (columns + 4 <= 0) {
11			! columns = INT_MAX - 4;
12			}
13			rows = rowsA;
14			endOfBlock = endOfBlockA;
15			black = blackA;
16			! refLine = (short *)gmallocn(columns + 3, sizeof(short));
17			! codingLine = (short *)gmallocn(columns + 2, sizeof(short));
18
19			eof = gFalse;
20			row = 0;
21			nextLine2D = encoding < 0;
22			inputBits = 0;
23			! codingLine[0] = 0;
24			! codingLine[1] = refLine[2] = columns;
25			! a0 = 1;
26
27			buf = EOF;
28			}
29			--- 1243,1268 ----
30			columns = columnsA;
31			if (columns < 1) {
32			columns = 1;
33			! } else if (columns > INT_MAX - 2) {
34			! columns = INT_MAX - 2;
35			}
36			rows = rowsA;
37			endOfBlock = endOfBlockA;
38			black = blackA;
39			! // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
40			! // ---> max codingLine size = columns + 1
41			! // refLine has one extra guard entry at the end
42			! // ---> max refLine size = columns + 2
43			! codingLine = (int *)gmallocn(columns + 1, sizeof(int));
44			! refLine = (int *)gmallocn(columns + 2, sizeof(int));
45
46			eof = gFalse;
47			row = 0;
48			nextLine2D = encoding < 0;
49			inputBits = 0;
50			! codingLine[0] = columns;
51			! a0i = 0;
52			! outputBits = 0;
53
54			buf = EOF;
55			}
56			***************
57			* 1278,1286 **
58			row = 0;
59			nextLine2D = encoding < 0;
60			inputBits = 0;
61			! codingLine[0] = 0;
62			! codingLine[1] = columns;
63			! a0 = 1;
64			buf = EOF;
65
66			// skip any initial zero bits and end-of-line marker, and get the 2D
67			--- 1281,1289 ----
68			row = 0;
69			nextLine2D = encoding < 0;
70			inputBits = 0;
71			! codingLine[0] = columns;
72			! a0i = 0;
73			! outputBits = 0;
74			buf = EOF;
75
76			// skip any initial zero bits and end-of-line marker, and get the 2D
77			***************
78			* 1297,1507 **
79			}
80			}
81
82			int CCITTFaxStream::lookChar() {
83			short code1, code2, code3;
84			! int a0New;
85			! GBool err, gotEOL;
86			! int ret;
87			! int bits, i;
88
89			! // if at eof just return EOF
90			! if (eof && codingLine[a0] >= columns) {
91			! return EOF;
92			}
93
94			// read the next row
95			! err = gFalse;
96			! if (codingLine[a0] >= columns) {
97
98			// 2-D encoding
99			if (nextLine2D) {
100			- // state:
101			- // a0New = current position in coding line (0 <= a0New <= columns)
102			- // codingLine[a0] = last change in coding line
103			- // (black-to-white if a0 is even,
104			- // white-to-black if a0 is odd)
105			- // refLine[b1] = next change in reference line of opposite color
106			- // to a0
107			- // invariants:
108			- // 0 <= codingLine[a0] <= a0New
109			- // <= refLine[b1] <= refLine[b1+1] <= columns
110			- // 0 <= a0 <= columns+1
111			- // refLine[0] = 0
112			- // refLine[n] = refLine[n+1] = columns
113			- // -- for some 1 <= n <= columns+1
114			- // end condition:
115			- // 0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
116			- // < codingLine[n-1] < codingLine[n] = columns
117			- // -- where 1 <= n <= columns+1
118			for (i = 0; codingLine[i] < columns; ++i) {
119			refLine[i] = codingLine[i];
120			}
121			! refLine[i] = refLine[i + 1] = columns;
122			! b1 = 1;
123			! a0New = codingLine[a0 = 0] = 0;
124			! do {
125			code1 = getTwoDimCode();
126			switch (code1) {
127			case twoDimPass:
128			! if (refLine[b1] < columns) {
129			! a0New = refLine[b1 + 1];
130			! b1 += 2;
131			}
132			break;
133			case twoDimHoriz:
134			! if ((a0 & 1) == 0) {
135			! code1 = code2 = 0;
136			do {
137			! code1 += code3 = getWhiteCode();
138			} while (code3 >= 64);
139			do {
140			! code2 += code3 = getBlackCode();
141			} while (code3 >= 64);
142			} else {
143			- code1 = code2 = 0;
144			do {
145			! code1 += code3 = getBlackCode();
146			} while (code3 >= 64);
147			do {
148			! code2 += code3 = getWhiteCode();
149			} while (code3 >= 64);
150			}
151			! if (code1 > 0 \|\| code2 > 0) {
152			! if (a0New + code1 <= columns) {
153			! codingLine[a0 + 1] = a0New + code1;
154			! } else {
155			! codingLine[a0 + 1] = columns;
156			! }
157			! ++a0;
158			! if (codingLine[a0] + code2 <= columns) {
159			! codingLine[a0 + 1] = codingLine[a0] + code2;
160			! } else {
161			! codingLine[a0 + 1] = columns;
162			! }
163			! ++a0;
164			! a0New = codingLine[a0];
165			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
166			! b1 += 2;
167			}
168			}
169			break;
170			! case twoDimVert0:
171			! if (refLine[b1] < columns) {
172			! a0New = codingLine[++a0] = refLine[b1];
173			! ++b1;
174			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
175			! b1 += 2;
176			}
177			- } else {
178			- a0New = codingLine[++a0] = columns;
179			}
180			break;
181			case twoDimVertR1:
182			! if (refLine[b1] + 1 < columns) {
183			! a0New = codingLine[++a0] = refLine[b1] + 1;
184			! ++b1;
185			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
186			! b1 += 2;
187			}
188			- } else {
189			- a0New = codingLine[++a0] = columns;
190			}
191			break;
192			! case twoDimVertL1:
193			! if (refLine[b1] - 1 > a0New \|\| (a0 == 0 && refLine[b1] == 1)) {
194			! a0New = codingLine[++a0] = refLine[b1] - 1;
195			! --b1;
196			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
197			! b1 += 2;
198			}
199			}
200			break;
201			! case twoDimVertR2:
202			! if (refLine[b1] + 2 < columns) {
203			! a0New = codingLine[++a0] = refLine[b1] + 2;
204			! ++b1;
205			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
206			! b1 += 2;
207			}
208			- } else {
209			- a0New = codingLine[++a0] = columns;
210			}
211			break;
212			case twoDimVertL2:
213			! if (refLine[b1] - 2 > a0New \|\| (a0 == 0 && refLine[b1] == 2)) {
214			! a0New = codingLine[++a0] = refLine[b1] - 2;
215			! --b1;
216			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
217			! b1 += 2;
218			}
219			! }
220			! break;
221			! case twoDimVertR3:
222			! if (refLine[b1] + 3 < columns) {
223			! a0New = codingLine[++a0] = refLine[b1] + 3;
224			! ++b1;
225			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
226			! b1 += 2;
227			}
228			- } else {
229			- a0New = codingLine[++a0] = columns;
230			}
231			break;
232			! case twoDimVertL3:
233			! if (refLine[b1] - 3 > a0New \|\| (a0 == 0 && refLine[b1] == 3)) {
234			! a0New = codingLine[++a0] = refLine[b1] - 3;
235			! --b1;
236			! while (refLine[b1] <= a0New && refLine[b1] < columns) {
237			! b1 += 2;
238			}
239			}
240			break;
241			case EOF:
242			eof = gTrue;
243			! codingLine[a0 = 0] = columns;
244			! return EOF;
245			default:
246			error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
247			err = gTrue;
248			break;
249			}
250			! } while (codingLine[a0] < columns);
251
252			// 1-D encoding
253			} else {
254			! codingLine[a0 = 0] = 0;
255			! while (1) {
256			code1 = 0;
257			! do {
258			! code1 += code3 = getWhiteCode();
259			! } while (code3 >= 64);
260			! codingLine[a0+1] = codingLine[a0] + code1;
261			! ++a0;
262			! if (codingLine[a0] >= columns) {
263			! break;
264			! }
265			! code2 = 0;
266			! do {
267			! code2 += code3 = getBlackCode();
268			! } while (code3 >= 64);
269			! codingLine[a0+1] = codingLine[a0] + code2;
270			! ++a0;
271			! if (codingLine[a0] >= columns) {
272			! break;
273			}
274			}
275			}
276
277			- if (codingLine[a0] != columns) {
278			- error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
279			- // force the row to be the correct length
280			- while (codingLine[a0] > columns) {
281			- --a0;
282			- }
283			- codingLine[++a0] = columns;
284			- err = gTrue;
285			- }
286			-
287			// byte-align the row
288			if (byteAlign) {
289			inputBits &= ~7;
290			--- 1300,1529 ----
291			}
292			}
293
294			+ inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
295			+ if (a1 > codingLine[a0i]) {
296			+ if (a1 > columns) {
297			+ error(getPos(), "CCITTFax row is wrong length (%d)", a1);
298			+ err = gTrue;
299			+ a1 = columns;
300			+ }
301			+ if ((a0i & 1) ^ blackPixels) {
302			+ ++a0i;
303			+ }
304			+ codingLine[a0i] = a1;
305			+ }
306			+ }
307			+
308			+ inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
309			+ if (a1 > codingLine[a0i]) {
310			+ if (a1 > columns) {
311			+ error(getPos(), "CCITTFax row is wrong length (%d)", a1);
312			+ err = gTrue;
313			+ a1 = columns;
314			+ }
315			+ if ((a0i & 1) ^ blackPixels) {
316			+ ++a0i;
317			+ }
318			+ codingLine[a0i] = a1;
319			+ } else if (a1 < codingLine[a0i]) {
320			+ if (a1 < 0) {
321			+ error(getPos(), "Invalid CCITTFax code");
322			+ err = gTrue;
323			+ a1 = 0;
324			+ }
325			+ while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
326			+ --a0i;
327			+ }
328			+ codingLine[a0i] = a1;
329			+ }
330			+ }
331			+
332			int CCITTFaxStream::lookChar() {
333			short code1, code2, code3;
334			! int b1i, blackPixels, i, bits;
335			! GBool gotEOL;
336
337			! if (buf != EOF) {
338			! return buf;
339			}
340
341			// read the next row
342			! if (outputBits == 0) {
343			!
344			! // if at eof just return EOF
345			! if (eof) {
346			! return EOF;
347			! }
348			!
349			! err = gFalse;
350
351			// 2-D encoding
352			if (nextLine2D) {
353			for (i = 0; codingLine[i] < columns; ++i) {
354			refLine[i] = codingLine[i];
355			}
356			! refLine[i++] = columns;
357			! refLine[i] = columns;
358			! codingLine[0] = 0;
359			! a0i = 0;
360			! b1i = 0;
361			! blackPixels = 0;
362			! // invariant:
363			! // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
364			! // <= columns
365			! // exception at left edge:
366			! // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
367			! // exception at right edge:
368			! // refLine[b1i] = refLine[b1i+1] = columns is possible
369			! while (codingLine[a0i] < columns) {
370			code1 = getTwoDimCode();
371			switch (code1) {
372			case twoDimPass:
373			! addPixels(refLine[b1i + 1], blackPixels);
374			! if (refLine[b1i + 1] < columns) {
375			! b1i += 2;
376			}
377			break;
378			case twoDimHoriz:
379			! code1 = code2 = 0;
380			! if (blackPixels) {
381			do {
382			! code1 += code3 = getBlackCode();
383			} while (code3 >= 64);
384			do {
385			! code2 += code3 = getWhiteCode();
386			} while (code3 >= 64);
387			} else {
388			do {
389			! code1 += code3 = getWhiteCode();
390			} while (code3 >= 64);
391			do {
392			! code2 += code3 = getBlackCode();
393			} while (code3 >= 64);
394			}
395			! addPixels(codingLine[a0i] + code1, blackPixels);
396			! if (codingLine[a0i] < columns) {
397			! addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
398			! }
399			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
400			! b1i += 2;
401			! }
402			! break;
403			! case twoDimVertR3:
404			! addPixels(refLine[b1i] + 3, blackPixels);
405			! blackPixels ^= 1;
406			! if (codingLine[a0i] < columns) {
407			! ++b1i;
408			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
409			! b1i += 2;
410			}
411			}
412			break;
413			! case twoDimVertR2:
414			! addPixels(refLine[b1i] + 2, blackPixels);
415			! blackPixels ^= 1;
416			! if (codingLine[a0i] < columns) {
417			! ++b1i;
418			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
419			! b1i += 2;
420			}
421			}
422			break;
423			case twoDimVertR1:
424			! addPixels(refLine[b1i] + 1, blackPixels);
425			! blackPixels ^= 1;
426			! if (codingLine[a0i] < columns) {
427			! ++b1i;
428			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
429			! b1i += 2;
430			}
431			}
432			break;
433			! case twoDimVert0:
434			! addPixels(refLine[b1i], blackPixels);
435			! blackPixels ^= 1;
436			! if (codingLine[a0i] < columns) {
437			! ++b1i;
438			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
439			! b1i += 2;
440			}
441			}
442			break;
443			! case twoDimVertL3:
444			! addPixelsNeg(refLine[b1i] - 3, blackPixels);
445			! blackPixels ^= 1;
446			! if (codingLine[a0i] < columns) {
447			! if (b1i > 0) {
448			! --b1i;
449			! } else {
450			! ++b1i;
451			! }
452			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
453			! b1i += 2;
454			}
455			}
456			break;
457			case twoDimVertL2:
458			! addPixelsNeg(refLine[b1i] - 2, blackPixels);
459			! blackPixels ^= 1;
460			! if (codingLine[a0i] < columns) {
461			! if (b1i > 0) {
462			! --b1i;
463			! } else {
464			! ++b1i;
465			}
466			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
467			! b1i += 2;
468			}
469			}
470			break;
471			! case twoDimVertL1:
472			! addPixelsNeg(refLine[b1i] - 1, blackPixels);
473			! blackPixels ^= 1;
474			! if (codingLine[a0i] < columns) {
475			! if (b1i > 0) {
476			! --b1i;
477			! } else {
478			! ++b1i;
479			! }
480			! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
481			! b1i += 2;
482			}
483			}
484			break;
485			case EOF:
486			+ addPixels(columns, 0);
487			eof = gTrue;
488			! break;
489			default:
490			error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
491			+ addPixels(columns, 0);
492			err = gTrue;
493			break;
494			}
495			! }
496
497			// 1-D encoding
498			} else {
499			! codingLine[0] = 0;
500			! a0i = 0;
501			! blackPixels = 0;
502			! while (codingLine[a0i] < columns) {
503			code1 = 0;
504			! if (blackPixels) {
505			! do {
506			! code1 += code3 = getBlackCode();
507			! } while (code3 >= 64);
508			! } else {
509			! do {
510			! code1 += code3 = getWhiteCode();
511			! } while (code3 >= 64);
512			}
513			+ addPixels(codingLine[a0i] + code1, blackPixels);
514			+ blackPixels ^= 1;
515			}
516			}
517
518			// byte-align the row
519			if (byteAlign) {
520			inputBits &= ~7;
521			***************
522			* 1560,1573 **
523			// this if we know the stream contains end-of-line markers because
524			// the "just plow on" technique tends to work better otherwise
525			} else if (err && endOfLine) {
526			! do {
527			if (code1 == EOF) {
528			eof = gTrue;
529			return EOF;
530			}
531			eatBits(1);
532			! code1 = lookBits(13);
533			! } while ((code1 >> 1) != 0x001);
534			eatBits(12);
535			if (encoding > 0) {
536			eatBits(1);
537			--- 1582,1598 ----
538			// this if we know the stream contains end-of-line markers because
539			// the "just plow on" technique tends to work better otherwise
540			} else if (err && endOfLine) {
541			! while (1) {
542			! code1 = lookBits(13);
543			if (code1 == EOF) {
544			eof = gTrue;
545			return EOF;
546			}
547			+ if ((code1 >> 1) == 0x001) {
548			+ break;
549			+ }
550			eatBits(1);
551			! }
552			eatBits(12);
553			if (encoding > 0) {
554			eatBits(1);
555			***************
556			* 1575,1585 **
557			}
558			}
559
560			! a0 = 0;
561			! outputBits = codingLine[1] - codingLine[0];
562			! if (outputBits == 0) {
563			! a0 = 1;
564			! outputBits = codingLine[2] - codingLine[1];
565			}
566
567			++row;
568			--- 1600,1610 ----
569			}
570			}
571
572			! // set up for output
573			! if (codingLine[0] > 0) {
574			! outputBits = codingLine[a0i = 0];
575			! } else {
576			! outputBits = codingLine[a0i = 1];
577			}
578
579			++row;
580			***************
581			* 1587,1625 **
582
583			// get a byte
584			if (outputBits >= 8) {
585			! ret = ((a0 & 1) == 0) ? 0xff : 0x00;
586			! if ((outputBits -= 8) == 0) {
587			! ++a0;
588			! if (codingLine[a0] < columns) {
589			! outputBits = codingLine[a0 + 1] - codingLine[a0];
590			! }
591			}
592			} else {
593			bits = 8;
594			! ret = 0;
595			do {
596			if (outputBits > bits) {
597			! i = bits;
598			! bits = 0;
599			! if ((a0 & 1) == 0) {
600			! ret \|= 0xff >> (8 - i);
601			}
602			! outputBits -= i;
603			} else {
604			! i = outputBits;
605			! bits -= outputBits;
606			! if ((a0 & 1) == 0) {
607			! ret \|= (0xff >> (8 - i)) << bits;
608			}
609			outputBits = 0;
610			! ++a0;
611			! if (codingLine[a0] < columns) {
612			! outputBits = codingLine[a0 + 1] - codingLine[a0];
613			}
614			}
615			! } while (bits > 0 && codingLine[a0] < columns);
616			}
617			- buf = black ? (ret ^ 0xff) : ret;
618			return buf;
619			}
620
621			--- 1612,1654 ----
622
623			// get a byte
624			if (outputBits >= 8) {
625			! buf = (a0i & 1) ? 0x00 : 0xff;
626			! outputBits -= 8;
627			! if (outputBits == 0 && codingLine[a0i] < columns) {
628			! ++a0i;
629			! outputBits = codingLine[a0i] - codingLine[a0i - 1];
630			}
631			} else {
632			bits = 8;
633			! buf = 0;
634			do {
635			if (outputBits > bits) {
636			! buf <<= bits;
637			! if (!(a0i & 1)) {
638			! buf \|= 0xff >> (8 - bits);
639			}
640			! outputBits -= bits;
641			! bits = 0;
642			} else {
643			! buf <<= outputBits;
644			! if (!(a0i & 1)) {
645			! buf \|= 0xff >> (8 - outputBits);
646			}
647			+ bits -= outputBits;
648			outputBits = 0;
649			! if (codingLine[a0i] < columns) {
650			! ++a0i;
651			! outputBits = codingLine[a0i] - codingLine[a0i - 1];
652			! } else if (bits > 0) {
653			! buf <<= bits;
654			! bits = 0;
655			}
656			}
657			! } while (bits);
658			! }
659			! if (black) {
660			! buf ^= 0xff;
661			}
662			return buf;
663			}
664
665			***************
666			* 1661,1666 **
667			--- 1690,1698 ----
668			code = 0; // make gcc happy
669			if (endOfBlock) {
670			code = lookBits(12);
671			+ if (code == EOF) {
672			+ return 1;
673			+ }
674			if ((code >> 5) == 0) {
675			p = &whiteTab1[code];
676			} else {
677			***************
678			* 1673,1678 **
679			--- 1705,1713 ----
680			} else {
681			for (n = 1; n <= 9; ++n) {
682			code = lookBits(n);
683			+ if (code == EOF) {
684			+ return 1;
685			+ }
686			if (n < 9) {
687			code <<= 9 - n;
688			}
689			***************
690			* 1684,1689 **
691			--- 1719,1727 ----
692			}
693			for (n = 11; n <= 12; ++n) {
694			code = lookBits(n);
695			+ if (code == EOF) {
696			+ return 1;
697			+ }
698			if (n < 12) {
699			code <<= 12 - n;
700			}
701			***************
702			* 1709,1717 **
703			code = 0; // make gcc happy
704			if (endOfBlock) {
705			code = lookBits(13);
706			if ((code >> 7) == 0) {
707			p = &blackTab1[code];
708			! } else if ((code >> 9) == 0) {
709			p = &blackTab2[(code >> 1) - 64];
710			} else {
711			p = &blackTab3[code >> 7];
712			--- 1747,1758 ----
713			code = 0; // make gcc happy
714			if (endOfBlock) {
715			code = lookBits(13);
716			+ if (code == EOF) {
717			+ return 1;
718			+ }
719			if ((code >> 7) == 0) {
720			p = &blackTab1[code];
721			! } else if ((code >> 9) == 0 && (code >> 7) != 0) {
722			p = &blackTab2[(code >> 1) - 64];
723			} else {
724			p = &blackTab3[code >> 7];
725			***************
726			* 1723,1728 **
727			--- 1764,1772 ----
728			} else {
729			for (n = 2; n <= 6; ++n) {
730			code = lookBits(n);
731			+ if (code == EOF) {
732			+ return 1;
733			+ }
734			if (n < 6) {
735			code <<= 6 - n;
736			}
737			***************
738			* 1734,1739 **
739			--- 1778,1786 ----
740			}
741			for (n = 7; n <= 12; ++n) {
742			code = lookBits(n);
743			+ if (code == EOF) {
744			+ return 1;
745			+ }
746			if (n < 12) {
747			code <<= 12 - n;
748			}
749			***************
750			* 1747,1752 **
751			--- 1794,1802 ----
752			}
753			for (n = 10; n <= 13; ++n) {
754			code = lookBits(n);
755			+ if (code == EOF) {
756			+ return 1;
757			+ }
758			if (n < 13) {
759			code <<= 13 - n;
760			}
761			***************
762			* 1961,1966 **
763			--- 2011,2022 ----
764			// allocate a buffer for the whole image
765			bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
766			bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
767			+ if (bufWidth <= 0 \|\| bufHeight <= 0 \|\|
768			+ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
769			+ error(getPos(), "Invalid image size in DCT stream");
770			+ y = height;
771			+ return;
772			+ }
773			for (i = 0; i < numComps; ++i) {
774			frameBuf[i] = (int )gmallocn(bufWidth bufHeight, sizeof(int));
775			memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
776			***************
777			* 3036,3041 **
778			--- 3092,3102 ----
779			}
780			scanInfo.firstCoeff = str->getChar();
781			scanInfo.lastCoeff = str->getChar();
782			+ if (scanInfo.firstCoeff < 0 \|\| scanInfo.lastCoeff > 63 \|\|
783			+ scanInfo.firstCoeff > scanInfo.lastCoeff) {
784			+ error(getPos(), "Bad DCT coefficient numbers in scan info block");
785			+ return gFalse;
786			+ }
787			c = str->getChar();
788			scanInfo.ah = (c >> 4) & 0x0f;
789			scanInfo.al = c & 0x0f;
790			diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.h xpdf-3.02/xpdf/Stream.h
791			*** xpdf-3.02pl1.orig/xpdf/Stream.h Tue Feb 27 14:05:52 2007
792			--- xpdf-3.02/xpdf/Stream.h Thu Oct 25 15:48:15 2007
793			***************
794			* 528,540 **
795			int row; // current row
796			int inputBuf; // input buffer
797			int inputBits; // number of bits in input buffer
798			! short *refLine; // reference line changing elements
799			! int b1; // index into refLine
800			! short *codingLine; // coding line changing elements
801			! int a0; // index into codingLine
802			int outputBits; // remaining ouput bits
803			int buf; // character buffer
804
805			short getTwoDimCode();
806			short getWhiteCode();
807			short getBlackCode();
808			--- 528,542 ----
809			int row; // current row
810			int inputBuf; // input buffer
811			int inputBits; // number of bits in input buffer
812			! int *codingLine; // coding line changing elements
813			! int *refLine; // reference line changing elements
814			! int a0i; // index into codingLine
815			! GBool err; // error on current line
816			int outputBits; // remaining ouput bits
817			int buf; // character buffer
818
819			+ void addPixels(int a1, int black);
820			+ void addPixelsNeg(int a1, int black);
821			short getTwoDimCode();
822			short getWhiteCode();
823			short getBlackCode();