Fix for CAN-2004-1125

2005-01-05  Marco Pesenti Gritti  <marco@gnome.org>

        * pdf/xpdf/Gfx.cc:
        * pdf/xpdf/GfxState.cc:

        Fix for CAN-2004-1125

diff --git a/ChangeLog b/ChangeLog
index 797cce47e422d801ab9e5be671445fe8de2ff04a..1ad4593d6dd1c5f6f960db34f0829e9a4d7ed1c2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2005-01-05  Marco Pesenti Gritti  <marco@gnome.org>
+
+       * pdf/xpdf/Gfx.cc:
+       * pdf/xpdf/GfxState.cc:
+
+       Fix for CAN-2004-1125
+
 2005-01-05  Marco Pesenti Gritti  <marco@gnome.org>
 
        * shell/ev-view.c: (ev_view_copy):

diff --git a/pdf/xpdf/Gfx.cc b/pdf/xpdf/Gfx.cc
index a52aa02ac8dbfe71ca43cf3774e3d2a047f8f7ca..e530213b6609bd249880a1830c1da1cc50228723 100644 (file)
--- a/pdf/xpdf/Gfx.cc
+++ b/pdf/xpdf/Gfx.cc
@@ -2654,7 +2654,9 @@ void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) {
     haveMask = gFalse;
     dict->lookup("Mask", &maskObj);
     if (maskObj.isArray()) {
-      for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+      for (i = 0;
+          i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+          ++i) {
        maskObj.arrayGet(i, &obj1);
        maskColors[i] = obj1.getInt();
        obj1.free();

diff --git a/pdf/xpdf/GfxState.cc b/pdf/xpdf/GfxState.cc
index be6040550181f6ff04f79ef1999a44a6c3d27f96..92e5ebb1d7bb2817af9663f12f936e576fec0c18 100644 (file)
--- a/pdf/xpdf/GfxState.cc
+++ b/pdf/xpdf/GfxState.cc
@@ -714,6 +714,11 @@ GfxColorSpace *GfxICCBasedColorSpace::parse(Array *arr) {
   }
   nCompsA = obj2.getInt();
   obj2.free();
+  if (nCompsA > gfxColorMaxComps) {
+    error(-1, "ICCBased color space with too many (%d > %d) components",
+         nCompsA, gfxColorMaxComps);
+    nCompsA = gfxColorMaxComps;
+  }
   if (dict->lookup("Alternate", &obj2)->isNull() ||
       !(altA = GfxColorSpace::parse(&obj2))) {
     switch (nCompsA) {
@@ -1060,7 +1065,7 @@ GfxColorSpace *GfxDeviceNColorSpace::parse(Array *arr) {
   }
   nCompsA = obj1.arrayGetLength();
   if (nCompsA > gfxColorMaxComps) {
-    error(-1, "DeviceN color space with more than %d > %d components",
+    error(-1, "DeviceN color space with too many (%d > %d) components",
          nCompsA, gfxColorMaxComps);
     nCompsA = gfxColorMaxComps;
   }