Attachment #337644 for bug #570183

View | Details | Raw Unified | Return to bug 570183
Collapse All | Expand All




  return grealloc(p, size, true);
}

SafeInt::SafeInt(const long long int cA)
{
  if (cA < -INT_MAX || INT_MAX < cA)
    integer_overflow("SafeInt::SafeInt(long long): ");
  c = cA;
}

SafeInt::SafeInt()
{  }

SafeInt::SafeInt(const SafeInt& copy): c(copy.c)
{  }

SafeInt SafeInt::create(const long long int cA)
{
  return SafeInt(cA);
}

int SafeInt::Int(void) const
{
  return c;
}

void SafeInt::integer_overflow(const char * prefix)
{
  fprintf(stderr, "error: %sinteger overflow", prefix);
  exit (1);
}

void SafeInt::division_by_zero(const char * prefix)
{
  fprintf(stderr, "error: %sdivide by zero", prefix);
  exit(1);
}

void SafeInt::shift_is_negative(const char * prefix)
{
  fprintf(stderr, "warning: %sbitwise shift amount is negative", prefix);
}

SafeInt& SafeInt::operator=(const int& cA)
{
  *this = SafeInt(cA);
  return *this;
}

bool SafeInt::operator==(const SafeInt& right) const
{
  return c == right.c;
}

bool SafeInt::operator!=(const SafeInt& right) const
{
  return c != right.c;
}

bool SafeInt::operator<(const SafeInt& right) const
{
  return c < right.c;
}

bool SafeInt::operator<=(const SafeInt& right) const
{
  return c <= right.c;
}

bool SafeInt::operator>(const SafeInt& right) const
{
  return c > right.c;
}

bool SafeInt::operator>=(const SafeInt& right) const
{
  return c >= right.c;
}

bool SafeInt::operator==(const int& right) const
{
  return c == right;
}

bool SafeInt::operator!=(const int& right) const
{
  return c != right;
}

bool SafeInt::operator<(const int& right) const
{
  return c < right;
}

bool SafeInt::operator<=(const int& right) const
{
  return c <= right;
}

bool SafeInt::operator>(const int& right) const
{
  return c > right;
}

bool SafeInt::operator>=(const int& right) const
{
  return c >= right;
}

bool operator==(const int& left, const SafeInt& right)
{
  return left == right.c;
}

bool operator!=(const int& left, const SafeInt& right)
{
  return left != right.c;
}

bool operator<(const int& left, const SafeInt& right)
{
  return left < right.c;
}

bool operator<=(const int& left, const SafeInt& right)
{
  return left <= right.c;
}

bool operator>(const int& left, const SafeInt& right)
{
  return left > right.c;
}

bool operator>=(const int& left, const SafeInt& right)
{
  return left >= right.c;
}

SafeInt SafeInt::operator+() const
{
  return SafeInt(*this);
}

SafeInt SafeInt::operator+(const SafeInt& right) const
{
  if (c*right.c > 0 &&
      ((c > 0 && c > INT_MAX - right.c) ||
       (c < 0 && c < -INT_MAX - right.c)))
    integer_overflow("SafeInt::operator+(): ");
  return SafeInt(c + right.c);
}

SafeInt SafeInt::operator-() const
{
  return SafeInt(-c);
}

SafeInt SafeInt::operator-(const SafeInt& right) const
{
  return *this + (-right);
}

SafeInt SafeInt::operator*(const SafeInt& right) const
{
  if (right.c != 0 && c*right.c/right.c != c)
    integer_overflow("SafeInt::operator*(): ");
  return SafeInt(c * right.c);
}

SafeInt SafeInt::operator/(const SafeInt& right) const
{
  return SafeInt(c / right.c);
}

SafeInt SafeInt::operator%(const SafeInt& right) const
{
  return SafeInt(c % right.c);
}

SafeInt SafeInt::operator/(const int& right) const
{
  if (right == 0)
    division_by_zero("SafeInt::operator/(): ");
  return SafeInt(c / right);
}

SafeInt SafeInt::operator%(const int& right) const
{
  return SafeInt(c % right);
}

SafeInt& SafeInt::operator+=(const SafeInt& right)
{
  *this = *this + right;
  return *this;
}

SafeInt& SafeInt::operator-=(const SafeInt& right)
{
  *this = *this - right;
  return *this;
}

SafeInt& SafeInt::operator*=(const SafeInt& right)
{
  *this = *this * right;
  return *this;
}

SafeInt& SafeInt::operator/=(const SafeInt& right)
{
  *this = *this / right;
  return *this;
}

SafeInt& SafeInt::operator%=(const SafeInt& right)
{
  *this = *this % right;
  return *this;
}

SafeInt& SafeInt::operator/=(const int& right)
{
  *this = *this / right;
  return *this;
}

SafeInt& SafeInt::operator%=(const int& right)
{
  *this = *this % right;
  return *this;
}

SafeInt& SafeInt::operator++()
{
  *this += one;
  return *this;
}

SafeInt SafeInt::operator++(int)
{
  SafeInt res(*this);
  *this += one;
  return res;
}

SafeInt& SafeInt::operator--()
{
  *this -= one;
  return *this;
}

SafeInt SafeInt::operator--(int)
{
  SafeInt res(*this);
  *this -= one;
  return res;
}

SafeInt operator+(const int& left, const SafeInt& right)
{
  return SafeInt(left) + right;
}

SafeInt operator-(const int& left, const SafeInt& right)
{
  return SafeInt(left) - right;
}

SafeInt operator*(const int& left, const SafeInt& right)
{
  return SafeInt(left) * right;
}

SafeInt operator/(const int& left, const SafeInt& right)
{
  return SafeInt(left) / right;
}

SafeInt operator%(const int& left, const SafeInt& right)
{
  return SafeInt(left) % right;
}

SafeInt SafeInt::operator<<(const int offset)
{
  if (offset < 0)
  {
    shift_is_negative("SafeInt::operator<<(): ");
    return *this >> -offset;
  }

  if ((c & (-1 << (sizeof(c)*8 - offset))) != 0)
    integer_overflow("SafeInt::operator<<(): ");
 return SafeInt(c << offset);
}

SafeInt SafeInt::operator>>(const int offset)
{
  if (offset < 0)
  {
    shift_is_negative("SafeInt::operator>>(): ");
    return *this << -offset;
  }

  return SafeInt(c >> offset);
}

SafeInt& SafeInt::operator<<=(const int offset)
{
  *this = *this << offset;
  return *this;
}

SafeInt& SafeInt::operator>>=(const int offset)
{
  *this = *this >> offset;
  return *this;
}

const SafeInt SafeInt::zero = SafeInt(0);
const SafeInt SafeInt::one = SafeInt(1);

inline static void *gmallocn(SafeInt nObjs, SafeInt objSize, bool checkoverflow) GMEM_EXCEP {
  SafeInt n;

  if (nObjs == SafeInt::create(0)) {
    return NULL;
  }
  n = nObjs * objSize;
  if (objSize <= SafeInt::create(0) || nObjs < SafeInt::create(0)) {
#if USE_EXCEPTIONS
    throw GMemException();
#else

    else exit(1);
#endif
  }
  return gmalloc(n.Int(), checkoverflow);
}

void *gmallocn(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
  return gmallocn(nObjs, objSize, false);
}

void *gmallocn(int nObjs, int objSize) GMEM_EXCEP {
  return gmallocn(nObjs, objSize, false);
}

void *gmallocn_checkoverflow(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
  return gmallocn(nObjs, objSize, true);
}

void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP {
  return gmallocn(nObjs, objSize, true);
}

  return gmallocn3(a, b, c, true);
}

inline static void *greallocn(void *p, SafeInt nObjs, SafeInt objSize, bool checkoverflow) GMEM_EXCEP {
  SafeInt n;

  if (nObjs == SafeInt::create(0)) {
    if (p) {
      gfree(p);
    }
    return NULL;
  }
  n = nObjs * objSize;
  if (objSize <= SafeInt::create(0) || nObjs < SafeInt::create(0)) {
#if USE_EXCEPTIONS
    throw GMemException();
#else

    else exit(1);
#endif
  }
  return grealloc(p, n.Int(), checkoverflow);
}

void *greallocn(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
  return greallocn(p, nObjs, objSize, false);
}

void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP {
  return greallocn(p, nObjs, objSize, false);
}


void *greallocn_checkoverflow(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
  return greallocn(p, nObjs, objSize, true);
}

void *greallocn_checkoverflow(void *p, int nObjs, int objSize) GMEM_EXCEP {
  return greallocn(p, nObjs, objSize, true);
}




#endif // USE_EXCEPTIONS

#ifdef __cplusplus
class SafeInt
{
  int c;

public:
  SafeInt();
  SafeInt(const SafeInt& copy);
  SafeInt(const long long int cA);
  static SafeInt create(const long long int cA);
  int Int(void) const;

  const static SafeInt zero;
  const static SafeInt one;

  static void integer_overflow(const char * prefix = NULL);
  static void division_by_zero(const char * prefix = NULL);
  static void shift_is_negative(const char * prefix = NULL);

  SafeInt& operator=(const int& cA);

  bool operator==(const SafeInt& right) const;
  bool operator!=(const SafeInt& right) const;
  bool operator<(const SafeInt& right) const;
  bool operator<=(const SafeInt& right) const;
  bool operator >(const SafeInt& right) const;
  bool operator >=(const SafeInt& right) const;

  bool operator==(const int& right) const;
  bool operator!=(const int& right) const;
  bool operator<(const int& right) const;
  bool operator<=(const int& right) const;
  bool operator >(const int& right) const;
  bool operator >=(const int& right) const;

  friend bool operator ==(const int &left, const SafeInt& right);
  friend bool operator !=(const int &left, const SafeInt& right);
  friend bool operator <(const int &left, const SafeInt& right);
  friend bool operator <=(const int &left, const SafeInt& right);
  friend bool operator >(const int &left, const SafeInt& right);
  friend bool operator >=(const int &left, const SafeInt& right);

  SafeInt operator+() const;
  SafeInt operator+(const SafeInt& right) const;
  SafeInt operator-() const;
  SafeInt operator-(const SafeInt& right) const;
  SafeInt operator*(const SafeInt& right) const;
  SafeInt operator/(const SafeInt& right) const;
  SafeInt operator%(const SafeInt& right) const;

  SafeInt operator/(const int& right) const;
  SafeInt operator%(const int& right) const;

  SafeInt& operator+=(const SafeInt& right);
  SafeInt& operator-=(const SafeInt& right);
  SafeInt& operator*=(const SafeInt& right);
  SafeInt& operator/=(const SafeInt& right);
  SafeInt& operator%=(const SafeInt& right);

  SafeInt& operator/=(const int& right);
  SafeInt& operator%=(const int& right);

  friend SafeInt operator+(const int& left, const SafeInt& right);
  friend SafeInt operator-(const int& left, const SafeInt& right);
  friend SafeInt operator*(const int& left, const SafeInt& right);
  friend SafeInt operator/(const int& left, const SafeInt& right);
  friend SafeInt operator%(const int& left, const SafeInt& right);

  SafeInt& operator++();
  SafeInt operator++(int);
  SafeInt& operator--();
  SafeInt operator--(int);

  SafeInt operator<<(const int offset);
  SafeInt operator>>(const int offset);

  SafeInt& operator<<=(const int offset);
  SafeInt& operator>>=(const int offset);
};

bool operator==(const int& left, const SafeInt& right);
bool operator!=(const int& left, const SafeInt& right);
bool operator<(const int& left, const SafeInt& right);
bool operator<=(const int& left, const SafeInt& right);
bool operator>(const int& left, const SafeInt& right);
bool operator>=(const int& left, const SafeInt& right);

SafeInt operator+(const int& left, const SafeInt& right);
SafeInt operator-(const int& left, const SafeInt& right);
SafeInt operator*(const int& left, const SafeInt& right);
SafeInt operator/(const int& left, const SafeInt& right);
SafeInt operator%(const int& left, const SafeInt& right);
#endif

#ifdef __cplusplus
extern "C" {
#endif


}
#endif


#ifdef __cplusplus
extern void *gmallocn(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
extern void *gmallocn_checkoverflow(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
extern void *greallocn(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
extern void *greallocn_checkoverflow(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
#endif

#endif




  return nameToGID->lookupInt(name);
}

Gushort *FoFiTrueType::getCIDToGIDMap(SafeInt *nCIDs) {
  FoFiType1C *ff;
  Gushort *map;
  int i;

}

void FoFiTrueType::convertToCIDType2(char *psName,
				     Gushort *cidMap, SafeInt nCIDs,
				     GBool needVerticalMetrics,
				     FoFiOutputFunc outputFunc,
				     void *outputStream) {

  (*outputFunc)(outputStream, "  end def\n", 10);
  (*outputFunc)(outputStream, "/GDBytes 2 def\n", 15);
  if (cidMap) {
    buf = GooString::format("/CIDCount {0:d} def\n", nCIDs.Int());
    (*outputFunc)(outputStream, buf->getCString(), buf->getLength());
    delete buf;
    if (nCIDs > 32767) {

    }
  } else {
    // direct mapping - just fill the string(s) with s[i]=i
    buf = GooString::format("/CIDCount {0:d} def\n", nGlyphs.Int());
    (*outputFunc)(outputStream, buf->getCString(), buf->getLength());
    delete buf;
    if (nGlyphs > 32767) {
      (*outputFunc)(outputStream, "/CIDMap [\n", 10);
      for (i = 0; i < nGlyphs; i += 32767) {
	j = nGlyphs.Int() - i < 32767 ? nGlyphs.Int() - i : 32767;
	buf = GooString::format("  {0:d} string 0 1 {1:d} {{\n", 2 * j, j - 1);
	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
	delete buf;

      }
      (*outputFunc)(outputStream, "] def\n", 6);
    } else {
      buf = GooString::format("/CIDMap {0:d} string\n", 2 * nGlyphs.Int());
      (*outputFunc)(outputStream, buf->getCString(), buf->getLength());
      delete buf;
      buf = GooString::format("  0 1 {0:d} {{\n", nGlyphs.Int() - 1);
      (*outputFunc)(outputStream, buf->getCString(), buf->getLength());
      delete buf;
      (*outputFunc)(outputStream,

  delete ff;
}

void FoFiTrueType::convertToType0(char *psName, Gushort *cidMap, SafeInt nCIDs,
				  GBool needVerticalMetrics,
				  FoFiOutputFunc outputFunc,
				  void *outputStream) {

  delete sfntsName;

  // write the descendant Type 42 fonts
  n = cidMap ? nCIDs.Int() : nGlyphs.Int();
  for (i = 0; i < n; i += 256) {
    (*outputFunc)(outputStream, "10 dict begin\n", 14);
    (*outputFunc)(outputStream, "/FontName /", 11);

  };
  GBool missingCmap, missingName, missingPost, missingOS2;
  GBool unsortedLoca, badCmapLen, abbrevHMTX;
  SafeInt nZeroLengthTables;
  int nHMetrics, advWidth, lsb;
  TrueTypeLoca *locaTable;
  TrueTypeTable *newTables;
  char *newNameTab, *newCmapTab, *newHHEATab, *newHMTXTab;
  SafeInt nNewTables;
  int cmapIdx, cmapLen, glyfLen, newNameLen, newCmapLen, next;
  int newHHEALen, newHMTXLen;
  Guint locaChecksum, glyfChecksum, fileChecksum;
  char *tableDir;

  missingOS2 = seekTable("OS/2") < 0;

  // read the loca table, check to see if it's sorted
  locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + SafeInt(1), sizeof(TrueTypeLoca));
  unsortedLoca = gFalse;
  i = seekTable("loca");
  pos = tables[i].offset;

  // the same pos value remain in the same order)
  glyfLen = 0; // make gcc happy
  if (unsortedLoca) {
    qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
	  &cmpTrueTypeLocaOffset);
    for (i = 0; i < nGlyphs; ++i) {
      locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset;
    }
    locaTable[nGlyphs.Int()].len = 0;
    qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
	  &cmpTrueTypeLocaIdx);
    pos = 0;
    for (i = 0; i <= nGlyphs; ++i) {

  // construct the new name table
  if (name) {
    n = strlen(name);
    newNameLen = (6 + 4*12 + 2 * (3*SafeInt(n) + 7) + 3).Int() & ~3;
    newNameTab = (char *)gmalloc(newNameLen);
    memset(newNameTab, 0, newNameLen);
    newNameTab[0] = 0;		// format selector

    for (i = 0; i < newHHEALen; ++i) {
      newHHEATab[i] = getU8(pos++, &ok);
    }
    newHHEATab[34] = nGlyphs.Int() >> 8;
    newHHEATab[35] = nGlyphs.Int() & 0xff;
    i = seekTable("hmtx");
    pos = tables[i].offset;
    newHMTXLen = (4 * nGlyphs).Int();
    newHMTXTab = (char *)gmalloc(newHMTXLen);
    advWidth = 0;
    for (i = 0; i < nHMetrics; ++i) {

      } else if (newTables[j].tag == cmapTag && badCmapLen) {
	newTables[j].len = cmapLen;
      } else if (newTables[j].tag == locaTag && unsortedLoca) {
	newTables[j].len = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2);
	newTables[j].checksum = locaChecksum;
      } else if (newTables[j].tag == glyfTag && unsortedLoca) {
	newTables[j].len = glyfLen;

    newTables[j].len = sizeof(os2Tab);
    ++j;
  }
  qsort(newTables, nNewTables.Int(), sizeof(TrueTypeTable),
	&cmpTrueTypeTableTag);
  pos = 12 + nNewTables.Int() * 16;
  for (i = 0; i < nNewTables; ++i) {
    newTables[i].offset = pos;
    pos += newTables[i].len;

  }

  // write the table directory
  tableDir = (char *)gmalloc((SafeInt(12) + nNewTables * SafeInt(16)).Int());
  tableDir[0] = 0x00;					// sfnt version
  tableDir[1] = 0x01;
  tableDir[2] = 0x00;
  tableDir[3] = 0x00;
  tableDir[4] = (char)((nNewTables.Int() >> 8) & 0xff);	// numTables
  tableDir[5] = (char)(nNewTables.Int() & 0xff);
  for (i = -1, t = (Guint)nNewTables.Int(); t; ++i, t >>= 1) ;
  t = 1 << (4 + i);
  tableDir[6] = (char)((t >> 8) & 0xff);		// searchRange
  tableDir[7] = (char)(t & 0xff);
  tableDir[8] = (char)((i >> 8) & 0xff);		// entrySelector
  tableDir[9] = (char)(i & 0xff);
  t = nNewTables.Int() * 16 - t;
  tableDir[10] = (char)((t >> 8) & 0xff);		// rangeShift
  tableDir[11] = (char)(t & 0xff);
  pos = 12;

    tableDir[pos+15] = (char) newTables[i].len;
    pos += 16;
  }
  (*outputFunc)(outputStream, tableDir, 12 + nNewTables.Int() * 16);

  // compute the file checksum
  fileChecksum = computeTableChecksum((Guchar *)tableDir,
				      12 + nNewTables.Int() * 16);
  for (i = 0; i < nNewTables; ++i) {
    fileChecksum += newTables[i].checksum;
  }

  Guchar tableDir[12 + nT42Tables*16];
  GBool ok;
  Guint checksum;
  SafeInt nNewTables;
  int length, pos, glyfPos, i, j, k;
  Guchar vheaTab[36] = {
    0, 1, 0, 0,			// table version number

  // table, cmpTrueTypeLocaPos uses offset as its primary sort key,
  // and idx as its secondary key (ensuring that adjacent entries with
  // the same pos value remain in the same order)
  locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + SafeInt(1), sizeof(TrueTypeLoca));
  i = seekTable("loca");
  pos = tables[i].offset;
  ok = gTrue;

      locaTable[i].origOffset = 2 * getU16BE(pos + i*2, &ok);
    }
  }
  qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
	&cmpTrueTypeLocaOffset);
  for (i = 0; i < nGlyphs; ++i) {
    locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset;
  }
  locaTable[nGlyphs.Int()].len = 0;
  qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
	&cmpTrueTypeLocaIdx);
  pos = 0;
  for (i = 0; i <= nGlyphs; ++i) {

  }

  // construct the new 'loca' table
  locaData = (Guchar *)gmallocn(nGlyphs + SafeInt(1), (locaFmt ? 4 : 2));
  for (i = 0; i <= nGlyphs; ++i) {
    pos = locaTable[i].newOffset;
    if (locaFmt) {


  // construct the new table headers, including table checksums
  // (pad each table out to a multiple of 4 bytes)
  pos = 12 + nNewTables.Int()*16;
  k = 0;
  for (i = 0; i < nT42Tables; ++i) {
    length = -1;

      length = 54;
      checksum = computeTableChecksum(headData, 54);
    } else if (i == t42LocaTable) {
      length = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2);
      checksum = computeTableChecksum(locaData, length);
    } else if (i == t42GlyfTable) {
      length = 0;

	length = sizeof(vheaTab);
	checksum = computeTableChecksum(vheaTab, length);
      } else if (needVerticalMetrics && i == t42VmtxTable) {
	length = (4 + (nGlyphs - 1) * 4).Int();
	vmtxTab = (Guchar *)gmalloc(length);
	vmtxTab[0] = advance / 256;
	vmtxTab[1] = advance % 256;

  tableDir[2] = 0x00;
  tableDir[3] = 0x00;
  tableDir[4] = 0;		// numTables
  tableDir[5] = nNewTables.Int();
  tableDir[6] = 0;		// searchRange
  tableDir[7] = (Guchar)128;
  tableDir[8] = 0;		// entrySelector
  tableDir[9] = 3;
  tableDir[10] = 0;		// rangeShift
  tableDir[11] = (Guchar)(16 * nNewTables.Int() - 128);
  pos = 12;
  for (i = 0; i < nNewTables; ++i) {
    tableDir[pos   ] = (Guchar)(newTables[i].tag >> 24);

  }

  // compute the font checksum and store it in the head table
  checksum = computeTableChecksum(tableDir, 12 + nNewTables.Int()*16);
  for (i = 0; i < nNewTables; ++i) {
    checksum += newTables[i].checksum;
  }

  }

  // write the table directory
  dumpString(tableDir, 12 + nNewTables.Int()*16, outputFunc, outputStream);

  // write the tables
  for (i = 0; i < nNewTables; ++i) {
    if (i == t42HeadTable) {
      dumpString(headData, 54, outputFunc, outputStream);
    } else if (i == t42LocaTable) {
      length = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2);
      dumpString(locaData, length, outputFunc, outputStream);
    } else if (i == t42GlyfTable) {
      glyfPos = tables[seekTable("glyf")].offset;

      parsedOk = gFalse;
      return;
    }
    if (tables[i].len < (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2)) {
      nGlyphs = tables[i].len / (locaFmt ? 4 : 2) - 1;
    }
    for (j = 0; j <= nGlyphs; ++j) {

      goto err;
    }
    if (n > nGlyphs) {
      n = nGlyphs.Int();
    }
    stringIdx = 0;
    stringPos = tablePos + 34 + 2*n;




  // Return the mapping from CIDs to GIDs, and return the number of
  // CIDs in *<nCIDs>.  This is only useful for CID fonts.  (Only
  // useful for OpenType CFF fonts.)
  Gushort *getCIDToGIDMap(SafeInt *nCIDs);

  // Returns the least restrictive embedding licensing right (as
  // defined by the TrueType spec):

  // name (so we don't need to depend on the 'name' table in the
  // font).  The <cidMap> array maps CIDs to GIDs; it has <nCIDs>
  // entries.  (Not useful for OpenType CFF fonts.)
  void convertToCIDType2(char *psName, Gushort *cidMap, SafeInt nCIDs,
			 GBool needVerticalMetrics,
			 FoFiOutputFunc outputFunc, void *outputStream);


  // PostScript font name (so we don't need to depend on the 'name'
  // table in the font).  The <cidMap> array maps CIDs to GIDs; it has
  // <nCIDs> entries.  (Not useful for OpenType CFF fonts.)
  void convertToType0(char *psName, Gushort *cidMap, SafeInt nCIDs,
		      GBool needVerticalMetrics,
		      FoFiOutputFunc outputFunc, void *outputStream);


  int checkGIDInCoverage(Guint coverage, Guint orgGID);

  TrueTypeTable *tables;
  SafeInt nTables;
  TrueTypeCmap *cmaps;
  int nCmaps;
  SafeInt nGlyphs;
  int locaFmt;
  int bbox[4];
  GooHash *nameToGID;




  return encoding;
}

Gushort *FoFiType1C::getCIDToGIDMap(SafeInt *nCIDs) {
  Gushort *map;
  SafeInt n;
  int i;

  // a CID font's top dict has ROS as the first operator
  if (topDict.firstOp != 0x0c1e) {

  }
  ++n;
  map = (Gushort *)gmallocn(n, sizeof(Gushort));
  memset(map, 0, n.Int() * sizeof(Gushort));
  for (i = 0; i < nGlyphs; ++i) {
    map[charset[i]] = i;
  }

  int *charStringOffsets;
  Type1CIndex subrIdx;
  Type1CIndexVal val;
  SafeInt nCIDs;
  int gdBytes;
  GooString *buf;
  char buf2[256];
  GBool ok;


  // build the charstrings
  charStrings = new GooString();
  charStringOffsets = (int *)gmallocn(nCIDs + SafeInt(1), sizeof(int));
  for (i = 0; i < nCIDs; ++i) {
    charStringOffsets[i] = charStrings->getLength();
    if ((gid = cidMap[i]) >= 0) {

      }
    }
  }
  charStringOffsets[nCIDs.Int()] = charStrings->getLength();

  // compute gdBytes = number of bytes needed for charstring offsets
  // (offset size needs to account for the charstring offset table,
  // with a worst case of five bytes per entry, plus the charstrings
  // themselves)
  i = (nCIDs.Int() + 1) * 5 + charStrings->getLength();
  if (i < 0x100) {
    gdBytes = 1;
  } else if (i < 0x10000) {

  (*outputFunc)(outputStream, "end def\n", 8);

  // CIDFont-specific entries
  buf = GooString::format("/CIDCount {0:d} def\n", nCIDs.Int());
  (*outputFunc)(outputStream, buf->getCString(), buf->getLength());
  delete buf;
  (*outputFunc)(outputStream, "/FDBytes 1 def\n", 15);

  }

  // FDArray entry
  buf = GooString::format("/FDArray {0:d} array\n", nFDs.Int());
  (*outputFunc)(outputStream, buf->getCString(), buf->getLength());
  delete buf;
  for (i = 0; i < nFDs; ++i) {

  (*outputFunc)(outputStream, "def\n", 4);

  // start the binary section
  offset = (nCIDs.Int() + 1) * (1 + gdBytes);
  buf = GooString::format("(Hex) {0:d} StartData\n",
			offset + charStrings->getLength());
  (*outputFunc)(outputStream, buf->getCString(), buf->getLength());

  int *cidMap;
  Type1CIndex subrIdx;
  Type1CIndexVal val;
  SafeInt nCIDs;
  GooString *buf;
  Type1CEexecBuf eb;
  GBool ok;

Lines 163-169 public: Link Here

(-)poppler-0.12.0/fofi/FoFiType1C.h (-2 / +2 lines)
163		163
164	// Return the mapping from CIDs to GIDs, and return the number of	164	// Return the mapping from CIDs to GIDs, and return the number of
165	// CIDs in *<nCIDs>. This is only useful for CID fonts.	165	// CIDs in *<nCIDs>. This is only useful for CID fonts.
166	Gushort getCIDToGIDMap(int nCIDs);	166	Gushort getCIDToGIDMap(SafeInt nCIDs);
167		167
168	// Convert to a Type 1 font, suitable for embedding in a PostScript	168	// Convert to a Type 1 font, suitable for embedding in a PostScript
169	// file. This is only useful with 8-bit fonts. If <newEncoding> is	169	// file. This is only useful with 8-bit fonts. If <newEncoding> is
Lines 228-234 private: Link Here
228	Type1CPrivateDict *privateDicts;	228	Type1CPrivateDict *privateDicts;
229		229
230	int nGlyphs;	230	int nGlyphs;
231	int nFDs;	231	SafeInt nFDs;
232	Guchar *fdSelect;	232	Guchar *fdSelect;
233	Gushort *charset;	233	Gushort *charset;
234	int gsubrBias;	234	int gsubrBias;




void GooHash::expand() {
  GooHashBucket **oldTab;
  GooHashBucket *p;
  int h, i;
  SafeInt oldSize;

  oldSize = size;
  oldTab = tab;

  for (p = key->getCString(), i = 0; i < key->getLength(); ++p, ++i) {
    h = 17 * h + (int)(*p & 0xff);
  }
  return (int)(h % size.Int());
}

int GooHash::hash(char *key) {

  for (p = key; *p; ++p) {
    h = 17 * h + (int)(*p & 0xff);
  }
  return (int)(h % size.Int());
}

Lines 53-59 private: Link Here

(-)poppler-0.12.0/goo/GooHash.h (-1 / +1 lines)
53	int hash(char *key);	53	int hash(char *key);
54		54
55	GBool deleteKeys; // set if key strings should be deleted	55	GBool deleteKeys; // set if key strings should be deleted
56	int size; // number of buckets	56	SafeInt size; // number of buckets
57	int len; // number of entries	57	int len; // number of entries
58	GooHashBucket **tab;	58	GooHashBucket **tab;
59	};	59	};




  if (length >= size) {
    expand();
  }
  data[(length++).Int()] = p;
}

void GooList::append(GooList *list) {

    expand();
  }
  for (i = 0; i < list->length; ++i) {
    data[(length++).Int()] = list->data[i];
  }
}


    expand();
  }
  if (i < length) {
    memmove(data+i+1, data+i, (length.Int() - i) * sizeof(void *));
  }
  data[i] = p;
  ++length;


  p = data[i];
  if (i < length - 1) {
    memmove(data+i, data+i+1, (length.Int() - i - 1) * sizeof(void *));
  }
  --length;
  if (size - length >= ((inc > 0) ? inc : size/2)) {

}

void GooList::sort(int (*cmp)(const void *obj1, const void *obj2)) {
  qsort(data, length.Int(), sizeof(void *), cmp);
}

void GooList::expand() {




#endif

#include "gtypes.h"
#include "gmem.h"

//------------------------------------------------------------------------
// GooList

  //----- general

  // Get the number of elements.
  int getLength() { return length.Int(); }

  //----- ordered list support


  void shrink();

  void **data;			// the list elements
  SafeInt size;			// size of data array
  SafeInt length;			// number of elements on list
  SafeInt inc;			// allocation increment
};

#define deleteGooList(list, T)                        \

Lines 274-280 GooString GooString::appendf(char fmt, Link Here

(-)poppler-0.12.0/goo/GooString.cc (-1 / +2 lines)
274		274
275	GooString GooString::appendfv(char fmt, va_list argList) {	275	GooString GooString::appendfv(char fmt, va_list argList) {
276	GooStringFormatArg *args;	276	GooStringFormatArg *args;
277	int argsLen, argsSize;	277	int argsLen;
		278	SafeInt argsSize;
278	GooStringFormatArg arg;	279	GooStringFormatArg arg;
279	int idx, width, prec;	280	int idx, width, prec;
280	GBool reverseAlign, zeroFill;	281	GBool reverseAlign, zeroFill;




  if (yp < 0 || yp > INT_MAX - 1) {
    return splashErrBadArg;
  }
  pixBuf = (SplashColorPtr)gmallocn((SafeInt(yp) + SafeInt(1)), SafeInt(w));

  // initialize the pixel pipe
  pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,

  }
  colorBuf = (SplashColorPtr)gmallocn3((yp + 1), w, nComps);
  if (srcAlpha) {
    alphaBuf = (Guchar *)gmalloc(((SafeInt(yp) + SafeInt(1)) * SafeInt(w)).Int());
  } else {
    alphaBuf = NULL;
  }

    // draw the start cap
    pathOut->moveTo(pathIn->pts[i].x - wdy, pathIn->pts[i].y + wdx);
    if (i == subpathStart) {
      firstPt = pathOut->length.Int() - 1;
    }
    if (first && !closed) {
      switch (state->lineCap) {

    }

    // draw the left side of the segment rectangle
    left2 = pathOut->length.Int() - 1;
    pathOut->lineTo(pathIn->pts[i+1].x + wdy, pathIn->pts[i+1].y - wdx);

    // draw the end cap

    }

    // draw the right side of the segment rectangle
    right2 = pathOut->length.Int() - 1;
    pathOut->close();

    // draw the join
    join2 = pathOut->length.Int();
    if (!last || closed) {
      crossprod = dx * dyNext - dy * dxNext;
      dotprod = -(dx * dxNext + dy * dyNext);

	if (i >= subpathStart + 2) {
	  pathOut->addStrokeAdjustHint(left1, right1, left0 + 1, right0);
	  pathOut->addStrokeAdjustHint(left1, right1,
				       join0, pathOut->length.Int() - 1);
	} else {
	  pathOut->addStrokeAdjustHint(left1, right1,
				       firstPt, pathOut->length.Int() - 1);
	}
	if (closed) {
	  pathOut->addStrokeAdjustHint(left1, right1, firstPt, leftFirst);

	  pathOut->addStrokeAdjustHint(leftFirst, rightFirst,
				       left1 + 1, right1);
	  pathOut->addStrokeAdjustHint(leftFirst, rightFirst,
				       join1, pathOut->length.Int() - 1);
	}
      }
    }




  void offset(SplashCoord dx, SplashCoord dy);

  // Get the points on the path.
  int getLength() { return length.Int(); }
  void getPoint(int i, double *x, double *y, Guchar *f)
    { *x = pts[i].x; *y = pts[i].y; *f = flags[i]; }



  SplashPathPoint *pts;		// array of points
  Guchar *flags;		// array of flags
  SafeInt length, size;		// length/size of the pts and flags arrays
  int curSubpath;		// index of first point in last subpath

  SplashPathHint *hints;	// list of hints
  SafeInt hintsLength, hintsSize;

  friend class SplashXPath;
  friend class Splash;

Lines 99-105 protected: Link Here

(-)poppler-0.12.0/splash/SplashClip.h (-1 / +2 lines)
99	SplashXPath **paths;	99	SplashXPath **paths;
100	Guchar *flags;	100	Guchar *flags;
101	SplashXPathScanner **scanners;	101	SplashXPathScanner **scanners;
102	int length, size;	102	int length;
		103	SafeInt size;
103	};	104	};
104		105
105	#endif	106	#endif




  paths = NULL;
  flags = NULL;
  scanners = NULL;
  length = 0;
  size = 0;
}

SplashClip::SplashClip(SplashClip *clip) {

  paths = NULL;
  flags = NULL;
  scanners = NULL;
  length = 0;
  size = 0;

  if (x0 < x1) {
    xMin = x0;




  FT_Vector offset;
  FT_GlyphSlot slot;
  FT_UInt gid;
  SafeInt rowSize;
  Guchar *p, *q;
  int i;


  if (aa) {
    rowSize = bitmap->w;
  } else {
    rowSize = (SafeInt(bitmap->w) + SafeInt(7)) >> 3;
  }
  bitmap->data = (Guchar *)gmallocn_checkoverflow(rowSize, bitmap->h);
  bitmap->freeData = gTrue;
  for (i = 0, p = bitmap->data, q = slot->bitmap.buffer;
       i < bitmap->h;
       ++i, p += rowSize.Int(), q += slot->bitmap.pitch) {
    memcpy(p, q, rowSize.Int());
  }

  return gTrue;




						SplashFontSrc *src) {
  FoFiType1C *ff;
  Gushort *cidToGIDMap;
  SafeInt nCIDs;
  SplashFontFile *ret;

  // check for a CFF font

      nCIDs = 0;
    }
  }
  ret = SplashFTFontFile::loadCIDFont(this, idA, src, cidToGIDMap, nCIDs.Int());
  if (!ret) {
    gfree(cidToGIDMap);
  }

  FoFiTrueType *ff;
  GBool isCID;
  Gushort *cidToGIDMap;
  SafeInt nCIDs;
  SplashFontFile *ret;

  cidToGIDMap = NULL;

    }
  }
  ret = SplashFTFontFile::loadCIDFont(this, idA, src,
				      cidToGIDMap, nCIDs.Int());
  if (!ret) {
    gfree(cidToGIDMap);
  }




    cacheTags = (SplashFontCacheTag *)gmallocn(cacheSets * cacheAssoc,
					     sizeof(SplashFontCacheTag));
    for (i = 0; i < cacheSets * cacheAssoc; ++i) {
      cacheTags[i].mru = i & (cacheAssoc.Int() - 1);
    }
  } else {
    cacheAssoc = 0;

  }

  // check the cache
  i = (c & (cacheSets.Int() - 1)) * cacheAssoc.Int();
  for (j = 0; j < cacheAssoc; ++j) {
    if ((cacheTags[i+j].mru & 0x80000000) &&
	cacheTags[i+j].c == c &&

  else
  {
    for (j = 0; j < cacheAssoc; ++j) {
      if ((cacheTags[i+j].mru & 0x7fffffff) == cacheAssoc.Int() - 1) {
        cacheTags[i+j].mru = 0x80000000;
        cacheTags[i+j].c = c;
        cacheTags[i+j].xFrac = (short)xFrac;

Lines 114-121 protected: Link Here

(-)poppler-0.12.0/splash/SplashFont.h (-2 / +2 lines)
114	cacheTags;	114	cacheTags;
115	int glyphW, glyphH; // size of glyph bitmaps	115	int glyphW, glyphH; // size of glyph bitmaps
116	int glyphSize; // size of glyph bitmaps, in bytes	116	int glyphSize; // size of glyph bitmaps, in bytes
117	int cacheSets; // number of sets in cache	117	SafeInt cacheSets; // number of sets in cache
118	int cacheAssoc; // cache associativity (glyphs per set)	118	SafeInt cacheAssoc; // cache associativity (glyphs per set)
119	};	119	};
120		120
121	#endif	121	#endif




  size = path->size;
  pts = (SplashPathPoint *)gmallocn(size, sizeof(SplashPathPoint));
  flags = (Guchar *)gmallocn(size, sizeof(Guchar));
  memcpy(pts, path->pts, length.Int() * sizeof(SplashPathPoint));
  memcpy(flags, path->flags, length.Int() * sizeof(Guchar));
  curSubpath = path->curSubpath;
  if (path->hints) {
    hintsLength = hintsSize = path->hintsLength;
    hints = (SplashPathHint *)gmallocn(hintsSize, sizeof(SplashPathHint));
    memcpy(hints, path->hints, hintsLength.Int() * sizeof(SplashPathHint));
  } else {
    hints = NULL;
  }

void SplashPath::append(SplashPath *path) {
  int i;

  curSubpath = length.Int() + path->curSubpath;
  grow(path->length.Int());
  for (i = 0; i < path->length; ++i) {
    pts[length.Int()] = path->pts[i];
    flags[length.Int()] = path->flags[i];
    ++length;
  }
}

    return splashErrBogusPath;
  }
  grow(1);
  pts[length.Int()].x = x;
  pts[length.Int()].y = y;
  flags[length.Int()] = splashPathFirst | splashPathLast;
  curSubpath = (length++).Int();
  return splashOk;
}


  if (noCurrentPoint()) {
    return splashErrNoCurPt;
  }
  flags[(length-1).Int()] &= ~splashPathLast;
  grow(1);
  pts[length.Int()].x = x;
  pts[length.Int()].y = y;
  flags[length.Int()] = splashPathLast;
  ++length;
  return splashOk;
}

  if (noCurrentPoint()) {
    return splashErrNoCurPt;
  }
  flags[(length-1).Int()] &= ~splashPathLast;
  grow(3);
  pts[length.Int()].x = x1;
  pts[length.Int()].y = y1;
  flags[length.Int()] = splashPathCurve;
  ++length;
  pts[length.Int()].x = x2;
  pts[length.Int()].y = y2;
  flags[length.Int()] = splashPathCurve;
  ++length;
  pts[length.Int()].x = x3;
  pts[length.Int()].y = y3;
  flags[length.Int()] = splashPathLast;
  ++length;
  return splashOk;
}

  if (noCurrentPoint()) {
    return splashErrNoCurPt;
  }
  if (curSubpath == length.Int() - 1 ||
      pts[length.Int() - 1].x != pts[curSubpath].x ||
      pts[length.Int() - 1].y != pts[curSubpath].y) {
    lineTo(pts[curSubpath].x, pts[curSubpath].y);
  }
  flags[curSubpath] |= splashPathClosed;
  flags[length.Int() - 1] |= splashPathClosed;
  curSubpath = length.Int();
  return splashOk;
}

void SplashPath::addStrokeAdjustHint(int ctrl0, int ctrl1,
				     int firstPt, int lastPt) {
  if (hintsLength == hintsSize) {
    hintsSize = hintsLength.Int() ? 2 * hintsLength : 8;
    hints = (SplashPathHint *)greallocn(hints, hintsSize,
					sizeof(SplashPathHint));
  }
  hints[hintsLength.Int()].ctrl0 = ctrl0;
  hints[hintsLength.Int()].ctrl1 = ctrl1;
  hints[hintsLength.Int()].firstPt = firstPt;
  hints[hintsLength.Int()].lastPt = lastPt;
  ++hintsLength;
}


  if (noCurrentPoint()) {
    return gFalse;
  }
  *x = pts[length.Int() - 1].x;
  *y = pts[length.Int() - 1].y;
  return gTrue;
}




    // size must be a power of 2
    for (size = 1; size < params->size; size <<= 1) ;
    mat = (Guchar *)gmallocn(size * size, sizeof(Guchar));
    buildDispersedMatrix((size/2).Int(), (size/2).Int(), 1, (size/2).Int(), 1);
    break;

  case splashScreenClustered:


  case splashScreenStochasticClustered:
    // size must be at least 2*r
    if (SafeInt(params->size) < 2 * SafeInt(params->dotRadius)) {
      size = 2 * SafeInt(params->dotRadius);
    } else {
      size = params->size;
    }

					int delta, int offset) {
  if (delta == 0) {
    // map values in [1, size^2] --> [1, 255]
    mat[i * size.Int() + j] = 1 + (254 * (val - 1)) / (size.Int() * size.Int() - 1);
  } else {
    buildDispersedMatrix(i, j,
			 val, delta / 2, 4*offset);
    buildDispersedMatrix((i + delta) % size.Int(), (j + delta) % size.Int(),
			 val + offset, delta / 2, 4*offset);
    buildDispersedMatrix((i + delta) % size.Int(), j,
			 val + 2*offset, delta / 2, 4*offset);
    buildDispersedMatrix((i + 2*delta) % size.Int(), (j + delta) % size.Int(),
			 val + 3*offset, delta / 2, 4*offset);
  }
}

  SplashCoord *dist;
  SplashCoord u, v, d;
  Guchar val;
  SafeInt size2;
  int x, y, x1, y1, i;

  size2 = size >> 1;

  // initialize the threshold matrix
  for (y = 0; y < size; ++y) {
    for (x = 0; x < size; ++x) {
      mat[y * size.Int() + x] = 0;
    }
  }


	u = (SplashCoord)x + 0.5 - 0;
	v = (SplashCoord)y + 0.5 - 0;
      } else {
	u = (SplashCoord)x + 0.5 - (SplashCoord)size2.Int();
	v = (SplashCoord)y + 0.5 - (SplashCoord)size2.Int();
      }
      dist[y * size2.Int() + x] = u*u + v*v;
    }
  }
  for (y = 0; y < size2; ++y) {
    for (x = 0; x < size2; ++x) {
      if (x < y) {
	u = (SplashCoord)x + 0.5 - 0;
	v = (SplashCoord)y + 0.5 - (SplashCoord)size2.Int();
      } else {
	u = (SplashCoord)x + 0.5 - (SplashCoord)size2.Int();
	v = (SplashCoord)y + 0.5 - 0;
      }
      dist[(size2.Int() + y) * size2.Int() + x] = u*u + v*v;
    }
  }


    d = -1;
    for (y = 0; y < size; ++y) {
      for (x = 0; x < size2; ++x) {
	if (mat[y * size.Int() + x] == 0 &&
	    dist[y * size2.Int() + x] > d) {
	  x1 = x;
	  y1 = y;
	  d = dist[y1 * size2.Int() + x1];
	}
      }
    }
    // map values in [0, 2*size*size2-1] --> [1, 255]
    val = 1 + (254 * (2*i)) / (2*size.Int()*size2.Int() - 1);
    mat[y1 * size.Int() + x1] = val;
    val = 1 + (254 * (2*i+1)) / (2*size.Int()*size2.Int() - 1);
    if (y1 < size2.Int()) {
      mat[(y1 + size2.Int()) * size.Int() + x1 + size2.Int()] = val;
    } else {
      mat[(y1 - size2.Int()) * size.Int() + x1 + size2.Int()] = val;
    }
  }


  int dx0, dx1, dx, dy0, dy1, dy;

  dx0 = abs(x0 - x1);
  dx1 = size.Int() - dx0;
  dx = dx0 < dx1 ? dx0 : dx1;
  dy0 = abs(y0 - y1);
  dy1 = size.Int() - dy0;
  dy = dy0 < dy1 ? dy0 : dy1;
  return dx * dx + dy * dy;
}

// Hardcopy, and Graphic Arts IV, SPIE Vol. 3648, pp. 496-505, 1999.
void SplashScreen::buildSCDMatrix(int r) {
  SplashScreenPoint *dots, *pts;
  SafeInt dotsLen, dotsSize;
  char *tmpl;
  char *grid;
  int *region, *dist;

    }
  }
  for (i = 0; i < size * size; ++i) {
    j = i + (int)((double)(size.Int() * size.Int() - i) *
		  (double)rand() / ((double)RAND_MAX + 1.0));
    x = pts[i].x;
    y = pts[i].y;

  }

  // construct the circle template
  tmpl = (char *)gmallocn((SafeInt(r)+SafeInt(1))*(SafeInt(r)+SafeInt(1)), sizeof(char));
  for (y = 0; y <= r; ++y) {
    for (x = 0; x <= r; ++x) {
      tmpl[y*(r+1) + x] = (x * y <= r * r) ? 1 : 0;

  grid = (char *)gmallocn(size * size, sizeof(char));
  for (y = 0; y < size; ++y) {
    for (x = 0; x < size; ++x) {
      grid[y*size.Int() + x] = 0;
    }
  }


  dotsLen = 0;
  dotsSize = 32;
  dots = (SplashScreenPoint *)gmallocn(dotsSize, sizeof(SplashScreenPoint));
  for (i = 0; i < size.Int() * size.Int(); ++i) {
    x = pts[i].x;
    y = pts[i].y;
    if (!grid[y*size.Int() + x]) {
      if (dotsLen == dotsSize) {
	dotsSize *= 2;
	dots = (SplashScreenPoint *)greallocn(dots, dotsSize,
					      sizeof(SplashScreenPoint));
      }
      dots[(dotsLen++).Int()] = pts[i];
      for (yy = 0; yy <= r; ++yy) {
	y0 = (y + yy) % size.Int();
	y1 = (y - yy + size.Int()) % size.Int();
	for (xx = 0; xx <= r; ++xx) {
	  if (tmpl[yy*(r+1) + xx]) {
	    x0 = (x + xx) % size.Int();
	    x1 = (x - xx + size.Int()) % size.Int();
	    grid[y0*size.Int() + x0] = 1;
	    grid[y0*size.Int() + x1] = 1;
	    grid[y1*size.Int() + x0] = 1;
	    grid[y1*size.Int() + x1] = 1;
	  }
	}
      }

	  dMin = d;
	}
      }
      region[y*size.Int() + x] = iMin;
      dist[y*size.Int() + x] = dMin;
    }
  }

  // compute threshold values
  for (i = 0; i < dotsLen; ++i) {
    n = 0;
    for (y = 0; y < size.Int(); ++y) {
      for (x = 0; x < size.Int(); ++x) {
	if (region[y*size.Int() + x] == i) {
	  pts[n].x = x;
	  pts[n].y = y;
	  pts[n].dist = distance(dots[i].x, dots[i].y, x, y);

    qsort(pts, n, sizeof(SplashScreenPoint), &cmpDistances);
    for (j = 0; j < n; ++j) {
      // map values in [0 .. n-1] --> [255 .. 1]
      mat[pts[j].y * size.Int() + pts[j].x] = 255 - (254 * j) / (n - 1);
    }
  }


SplashScreen::SplashScreen(SplashScreen *screen) {
  size = screen->size;
  mat = (Guchar *)gmallocn(size * size, sizeof(Guchar));
  memcpy(mat, screen->mat, (size * size).Int() * sizeof(Guchar));
  minVal = screen->minVal;
  maxVal = screen->maxVal;
}

  if (value >= maxVal) {
    return 1;
  }
  if ((xx = x % size.Int()) < 0) {
    xx = -xx;
  }
  if ((yy = y % size.Int()) < 0) {
    yy = -yy;
  }
  return value < mat[yy * size.Int() + xx] ? 0 : 1;
}

GBool SplashScreen::isStatic(Guchar value) {

Lines 12-22 Link Here

(-)poppler-0.12.0/splash/SplashScreen.h (-1 / +5 lines)
12	#endif	12	#endif
13		13
14	#include "SplashTypes.h"	14	#include "SplashTypes.h"
		15	#include "gmem.h"
15		16
16	//------------------------------------------------------------------------	17	//------------------------------------------------------------------------
17	// SplashScreen	18	// SplashScreen
18	//------------------------------------------------------------------------	19	//------------------------------------------------------------------------
19		20
		21	class SafeInt;
		22
20	class SplashScreen {	23	class SplashScreen {
21	public:	24	public:
22		25
Lines 44-50 private: Link Here
44	void buildSCDMatrix(int r);	47	void buildSCDMatrix(int r);
45		48
46	Guchar *mat; // threshold matrix	49	Guchar *mat; // threshold matrix
47	int size; // size of the threshold matrix	50	SafeInt size; // size of the threshold matrix
		51
48	Guchar minVal; // any pixel value below minVal generates	52	Guchar minVal; // any pixel value below minVal generates
49	// solid black	53	// solid black
50	Guchar maxVal; // any pixel value above maxVal generates	54	Guchar maxVal; // any pixel value above maxVal generates

Lines 197-203 GBool SplashT1Font::getGlyph(int c, int Link Here

(-)poppler-0.12.0/splash/SplashT1Font.cc (-2 / +3 lines)
197	GBool SplashT1Font::makeGlyph(int c, int xFrac, int yFrac,	197	GBool SplashT1Font::makeGlyph(int c, int xFrac, int yFrac,
198	SplashGlyphBitmap bitmap, int x0, int y0, SplashClip clip, SplashClipResult *clipRes) {	198	SplashGlyphBitmap bitmap, int x0, int y0, SplashClip clip, SplashClipResult *clipRes) {
199	GLYPH *glyph;	199	GLYPH *glyph;
200	int n, i;	200	int i;
		201	SafeInt n;
201		202
202	if (aa) {	203	if (aa) {
203	glyph = T1_AASetChar(t1libID, c, size, NULL);	204	glyph = T1_AASetChar(t1libID, c, size, NULL);
Lines 217-223 GBool SplashT1Font::makeGlyph(int c, int Link Here
217	bitmap->data = (Guchar *)glyph->bits;	218	bitmap->data = (Guchar *)glyph->bits;
218	bitmap->freeData = gFalse;	219	bitmap->freeData = gFalse;
219	} else {	220	} else {
220	n = bitmap->h * ((bitmap->w + 7) >> 3);	221	n = SafeInt(bitmap->h) * ((SafeInt(bitmap->w) + SafeInt(7)) >> SafeInt(3));
221	bitmap->data = (Guchar *)gmalloc(n);	222	bitmap->data = (Guchar *)gmalloc(n);
222	for (i = 0; i < n; ++i) {	223	for (i = 0; i < n; ++i) {
223	bitmap->data[i] = bitReverse[glyph->bits[i] & 0xff];	224	bitmap->data[i] = bitReverse[glyph->bits[i] & 0xff];

Lines 47-53 SplashFontFile *SplashT1FontFile::loadTy Link Here

(-)poppler-0.12.0/splash/SplashT1FontFile.cc (-2 / +2 lines)
47	int t1libIDA;	47	int t1libIDA;
48	char **encTmp;	48	char **encTmp;
49	char *encStrTmp;	49	char *encStrTmp;
50	int encStrSize;	50	SafeInt encStrSize;
51	char *encPtr;	51	char *encPtr;
52	int i;	52	int i;
53		53
Lines 79-85 SplashFontFile *SplashT1FontFile::loadTy Link Here
79	encStrSize = 0;	79	encStrSize = 0;
80	for (i = 0; i < 256; ++i) {	80	for (i = 0; i < 256; ++i) {
81	if (encA[i]) {	81	if (encA[i]) {
82	encStrSize += strlen(encA[i]) + 1;	82	encStrSize += SafeInt(strlen(encA[i])) + SafeInt(1);
83	}	83	}
84	}	84	}
85	encTmp = (char *)gmallocn(257, sizeof(char ));	85	encTmp = (char *)gmallocn(257, sizeof(char ));




      xsp = x0;
      ysp = y0;
      curSubpath = i;
      curSubpathX = length.Int();
      ++i;

    } else {

  length = xPath->length;
  size = xPath->size;
  segs = (SplashXPathSeg *)gmallocn(size, sizeof(SplashXPathSeg));
  memcpy(segs, xPath->segs, length.Int() * sizeof(SplashXPathSeg));
}

SplashXPath::~SplashXPath() {

			     SplashCoord x1, SplashCoord y1,
			     GBool first, GBool last, GBool end0, GBool end1) {
  grow(1);
  segs[length.Int()].x0 = x0;
  segs[length.Int()].y0 = y0;
  segs[length.Int()].x1 = x1;
  segs[length.Int()].y1 = y1;
  segs[length.Int()].flags = 0;
  if (first) {
    segs[length.Int()].flags |= splashXPathFirst;
  }
  if (last) {
    segs[length.Int()].flags |= splashXPathLast;
  }
  if (end0) {
    segs[length.Int()].flags |= splashXPathEnd0;
  }
  if (end1) {
    segs[length.Int()].flags |= splashXPathEnd1;
  }
  if (y1 == y0) {
    segs[length.Int()].dxdy = segs[length.Int()].dydx = 0;
    segs[length.Int()].flags |= splashXPathHoriz;
    if (x1 == x0) {
      segs[length.Int()].flags |= splashXPathVert;
    }
  } else if (x1 == x0) {
    segs[length.Int()].dxdy = segs[length.Int()].dydx = 0;
    segs[length.Int()].flags |= splashXPathVert;
  } else {
#if USE_FIXEDPOINT
    if (FixedPoint::divCheck(x1 - x0, y1 - y0, &segs[length.Int()].dxdy)) {
      segs[length.Int()].dydx = (SplashCoord)1 / segs[length.Int()].dxdy;
    } else {
      segs[length.Int()].dxdy = segs[length.Int()].dydx = 0;
      if (splashAbs(x1 - x0) > splashAbs(y1 - y0)) {
	segs[length.Int()].flags |= splashXPathHoriz;
      } else {
	segs[length.Int()].flags |= splashXPathVert;
      }
    }
#else
    segs[length.Int()].dxdy = (x1 - x0) / (y1 - y0);
    segs[length.Int()].dydx = (SplashCoord)1 / segs[length.Int()].dxdy;
#endif
  }
  if (y0 > y1) {
    segs[length.Int()].flags |= splashXPathFlip;
  }
  ++length;
}

}

void SplashXPath::sort() {
  qsort(segs, length.Int(), sizeof(SplashXPathSeg), &cmpXPathSegs);
}

Lines 88-94 protected: Link Here

(-)poppler-0.12.0/splash/SplashXPath.h (-1 / +1 lines)
88	GBool first, GBool last, GBool end0, GBool end1);	88	GBool first, GBool last, GBool end0, GBool end1);
89		89
90	SplashXPathSeg *segs;	90	SplashXPathSeg *segs;
91	int length, size; // length and size of segs array	91	SafeInt length, size; // length and size of segs array
92		92
93	friend class SplashXPathScanner;	93	friend class SplashXPathScanner;
94	friend class SplashClip;	94	friend class SplashClip;

Lines 106-112 SplashXPathScanner::SplashXPathScanner(S Link Here

(-)poppler-0.12.0/splash/SplashXPathScanner.cc (-1 / +2 lines)
106	interY = yMin - 1;	106	interY = yMin - 1;
107	xPathIdx = 0;	107	xPathIdx = 0;
108	inter = NULL;	108	inter = NULL;
109	interLen = interSize = 0;	109	interLen = 0;
		110	interSize = 0;
110	}	111	}
111		112
112	SplashXPathScanner::~SplashXPathScanner() {	113	SplashXPathScanner::~SplashXPathScanner() {

Lines 79-85 private: Link Here

(-)poppler-0.12.0/splash/SplashXPathScanner.h (-1 / +1 lines)
79	// computeIntersections	79	// computeIntersections
80	SplashIntersect *inter; // intersections array for <interY>	80	SplashIntersect *inter; // intersections array for <interY>
81	int interLen; // number of intersections in <inter>	81	int interLen; // number of intersections in <inter>
82	int interSize; // size of the <inter> array	82	SafeInt interSize; // size of the <inter> array
83	};	83	};
84		84
85	#endif	85	#endif

Lines 4362-4368 Annot3D::Activation::Activation(Dict *di Link Here

(-)poppler-0.12.0/poppler/Annot.cc (-1 / +1 lines)
4362	Annots::Annots(XRef xref, Catalog catalog, Object *annotsObj) {	4362	Annots::Annots(XRef xref, Catalog catalog, Object *annotsObj) {
4363	Annot *annot;	4363	Annot *annot;
4364	Object obj1;	4364	Object obj1;
4365	int size;	4365	SafeInt size;
4366	int i;	4366	int i;
4367		4367
4368	annots = NULL;	4368	annots = NULL;

Lines 60-66 void Array::add(Object *elem) { Link Here

(-)poppler-0.12.0/poppler/Array.cc (-1 / +1 lines)
60	}	60	}
61	elems = (Object *)greallocn(elems, size, sizeof(Object));	61	elems = (Object *)greallocn(elems, size, sizeof(Object));
62	}	62	}
63	elems[length] = *elem;	63	elems[length.Int()] = *elem;
64	++length;	64	++length;
65	}	65	}
66		66

Lines 49-55 public: Link Here

(-)poppler-0.12.0/poppler/Array.h (-3 / +3 lines)
49	int decRef() { return --ref; }	49	int decRef() { return --ref; }
50		50
51	// Get number of elements.	51	// Get number of elements.
52	int getLength() { return length; }	52	int getLength() { return length.Int(); }
53		53
54	// Add an element.	54	// Add an element.
55	void add(Object *elem);	55	void add(Object *elem);
Lines 63-70 private: Link Here
63		63
64	XRef *xref; // the xref table for this PDF file	64	XRef *xref; // the xref table for this PDF file
65	Object *elems; // array of elements	65	Object *elems; // array of elements
66	int size; // size of <elems> array	66	SafeInt size; // size of <elems> array
67	int length; // number of elements in array	67	SafeInt length; // number of elements in array
68	int ref; // reference count	68	int ref; // reference count
69	};	69	};
70		70

Lines 65-71 Catalog::Catalog(XRef *xrefA) { Link Here

(-)poppler-0.12.0/poppler/Catalog.cc (-2 / +2 lines)
65	xref = xrefA;	65	xref = xrefA;
66	pages = NULL;	66	pages = NULL;
67	pageRefs = NULL;	67	pageRefs = NULL;
68	numPages = pagesSize = 0;	68	pagesSize = numPages = 0;
69	baseURI = NULL;	69	baseURI = NULL;
70	pageLabelInfo = NULL;	70	pageLabelInfo = NULL;
71	form = NULL;	71	form = NULL;
Lines 318-324 int Catalog::readPageTree(Dict *pagesDic Link Here
318	pagesSize += 32;	318	pagesSize += 32;
319	pages = (Page *)greallocn(pages, pagesSize, sizeof(Page ));	319	pages = (Page *)greallocn(pages, pagesSize, sizeof(Page ));
320	pageRefs = (Ref *)greallocn(pageRefs, pagesSize, sizeof(Ref));	320	pageRefs = (Ref *)greallocn(pageRefs, pagesSize, sizeof(Ref));
321	for (j = pagesSize - 32; j < pagesSize; ++j) {	321	for (j = (pagesSize - 32).Int(); j < pagesSize; ++j) {
322	pages[j] = NULL;	322	pages[j] = NULL;
323	pageRefs[j].num = -1;	323	pageRefs[j].num = -1;
324	pageRefs[j].gen = -1;	324	pageRefs[j].gen = -1;

Lines 228-234 private: Link Here

(-)poppler-0.12.0/poppler/Catalog.h (-1 / +1 lines)
228	Ref *pageRefs; // object ID for each page	228	Ref *pageRefs; // object ID for each page
229	Form *form;	229	Form *form;
230	int numPages; // number of pages	230	int numPages; // number of pages
231	int pagesSize; // size of pages array	231	SafeInt pagesSize; // size of pages array
232	Object dests; // named destination dictionary	232	Object dests; // named destination dictionary
233	NameTree destNameTree; // named destination name-tree	233	NameTree destNameTree; // named destination name-tree
234	NameTree embeddedFileNameTree; // embedded file name-tree	234	NameTree embeddedFileNameTree; // embedded file name-tree




							GooString *collection) {
  FILE *f;
  Unicode *mapA;
  CharCode mapLenA;
  SafeInt size;
  char buf[64];
  Unicode u;
  CharCodeToUnicode *ctu;

  FILE *f;
  Unicode *mapA;
  CharCodeToUnicodeString *sMapA;
  CharCode len, sMapLenA;
  SafeInt size, oldSize, sMapSizeA;
  char buf[256];
  char *tok;
  Unicode u0;


  size = 4096;
  mapA = (Unicode *)gmallocn(size, sizeof(Unicode));
  memset(mapA, 0, size.Int() * sizeof(Unicode));
  len = 0;
  sMapA = NULL;
  sMapSizeA = sMapLenA = 0;

	size *= 2;
      }
      mapA = (Unicode *)greallocn(mapA, size, sizeof(Unicode));
      memset(mapA + oldSize.Int(), 0, (size - oldSize).Int() * sizeof(Unicode));
    }
    if (n == 1) {
      mapA[u0] = uBuf[0];

  fclose(f);

  ctu = new CharCodeToUnicode(fileName->copy(), mapA, len, gTrue,
			      sMapA, sMapLenA, sMapSizeA.Int());
  gfree(mapA);
  gfree(uBuf);
  return ctu;


  if (code >= mapLen) {
    oldLen = mapLen;
    mapLen = (SafeInt(code) + 256).Int() & ~255;
    map = (Unicode *)greallocn(map, mapLen, sizeof(Unicode));
    for (i = oldLen; i < mapLen; ++i) {
      map[i] = 0;

    map[i] = 0;
  }
  sMap = NULL;
  sMapSize = sMapLen = 0;
  refCnt = 1;
#if MULTITHREADED
  gInitMutex(&mutex);

Lines 104-110 private: Link Here

(-)poppler-0.12.0/poppler/CharCodeToUnicode.h (-1 / +2 lines)
104	Unicode *map;	104	Unicode *map;
105	CharCode mapLen;	105	CharCode mapLen;
106	CharCodeToUnicodeString *sMap;	106	CharCodeToUnicodeString *sMap;
107	int sMapLen, sMapSize;	107	int sMapLen;
		108	SafeInt sMapSize;
108	int refCnt;	109	int refCnt;
109	#if MULTITHREADED	110	#if MULTITHREADED
110	GooMutex mutex;	111	GooMutex mutex;

Lines 130-136 GBool Decrypt::makeFileKey2(int encVersi Link Here

(-)poppler-0.12.0/poppler/Decrypt.cc (-1 / +1 lines)
130	GBool ok;	130	GBool ok;
131		131
132	// generate file key	132	// generate file key
133	buf = (Guchar *)gmalloc(72 + fileID->getLength());	133	buf = (Guchar *)gmalloc((SafeInt(72) + SafeInt(fileID->getLength())).Int());
134	if (userPassword) {	134	if (userPassword) {
135	len = userPassword->getLength();	135	len = userPassword->getLength();
136	if (len < 32) {	136	if (len < 32) {

Lines 88-94 private: Link Here

(-)poppler-0.12.0/poppler/Dict.h (-1 / +1 lines)
88		88
89	XRef *xref; // the xref table for this PDF file	89	XRef *xref; // the xref table for this PDF file
90	DictEntry *entries; // array of entries	90	DictEntry *entries; // array of entries
91	int size; // size of <entries> array	91	SafeInt size; // size of <entries> array
92	int length; // number of entries in dictionary	92	int length; // number of entries in dictionary
93	int ref; // reference count	93	int ref; // reference count
94		94




  }

  //----- buffer
  sBuf = (double *)gmallocn((SafeInt(1) << m).Int(), sizeof(double));

  //----- get the stream
  if (!funcObj->isStream()) {

SampledFunction::SampledFunction(SampledFunction *func) {
  memcpy(this, func, sizeof(SampledFunction));
  samples = (double *)gmallocn(nSamples, sizeof(double));
  memcpy(samples, func->samples, (nSamples * sizeof(double)).Int());
  sBuf = (double *)gmallocn((SafeInt(1) << m).Int(), sizeof(double));
}

void SampledFunction::transform(double *in, double *out) {

  }
  k = obj1.arrayGetLength();
  funcs = (Function **)gmallocn(k, sizeof(Function *));
  bounds = (double *)gmallocn(k + SafeInt(1), sizeof(double));
  encode = (double *)gmallocn(SafeInt(2) * k, sizeof(double));
  scale = (double *)gmallocn(k, sizeof(double));
  for (i = 0; i < k; ++i) {
    funcs[i] = NULL;

    bounds[i] = obj2.getNum();
    obj2.free();
  }
  bounds[k.Int()] = domain[0][1];
  obj1.free();

  //----- Encode

  for (i = 0; i < k; ++i) {
    funcs[i] = func->funcs[i]->copy();
  }
  bounds = (double *)gmallocn(k + SafeInt(1), sizeof(double));
  memcpy(bounds, func->bounds, ((k + 1) * sizeof(double)).Int());
  encode = (double *)gmallocn(SafeInt(2) * k, sizeof(double));
  memcpy(encode, func->encode, (2 * k * sizeof(double)).Int());
  scale = (double *)gmallocn(k, sizeof(double));
  memcpy(scale, func->scale, (k * sizeof(double)).Int());
  ok = gTrue;
}


PostScriptFunction::PostScriptFunction(PostScriptFunction *func) {
  memcpy(this, func, sizeof(PostScriptFunction));
  code = (PSObject *)gmallocn(codeSize, sizeof(PSObject));
  memcpy(code, func->code, (codeSize * sizeof(PSObject)).Int());
  codeString = func->codeString->copy();
  stack = new PSStack();
  memcpy(stack, func->stack, sizeof(PSStack));




    inputMul[funcMaxInputs];
  int idxMul[funcMaxInputs];	// sample array index multipliers
  double *samples;		// the samples
  SafeInt nSamples;			// size of the samples array
  double *sBuf;			// buffer for the transform function
  GBool ok;
};

  virtual void transform(double *in, double *out);
  virtual GBool isOk() { return ok; }

  int getNumFuncs() { return k.Int(); }
  Function *getFunc(int i) { return funcs[i]; }
  double *getBounds() { return bounds; }
  double *getEncode() { return encode; }


  StitchingFunction(StitchingFunction *func);

  SafeInt k;
  Function **funcs;
  double *bounds;
  double *encode;

  GooString *codeString;
  PSObject *code;
  PSStack *stack;
  SafeInt codeSize;
  GBool ok;
  PopplerCache *cache;
};




  Object obj1, obj2;
  Stream *str;
  int c;
  SafeInt size;
  int i;

  obj1.initRef(embFontID.num, embFontID.gen);
  obj1.fetch(xref, &obj2);

  str = obj2.getStream();

  buf = NULL;
  size = i = 0;
  str->reset();
  while ((c = str->getChar()) != EOF) {
    if (i == size) {
      size += 4096;
      buf = (char *)grealloc(buf, size.Int());
    }
    buf[i++] = c;
  }

  CharCode c;
  Unicode *uBuf;
  int c1, c2;
  int j, k, n;
  SafeInt i, excepsSize;

  refCnt = 1;
  ascent = 0.95;

    excepsSize = 0;
    i = 0;
    while (i + 1 < obj1.arrayGetLength()) {
      obj1.arrayGet(i.Int(), &obj2);
      obj1.arrayGet((i + 1).Int(), &obj3);
      if (obj2.isInt() && obj3.isInt() && (i + 2).Int() < obj1.arrayGetLength()) {
	if (obj1.arrayGet((i + 2).Int(), &obj4)->isNum()) {
	  if (widths.nExceps == excepsSize) {
	    excepsSize += 16;
	    widths.exceps = (GfxFontCIDWidthExcep *)

	i += 3;
      } else if (obj2.isInt() && obj3.isArray()) {
	if (widths.nExceps + obj3.arrayGetLength() > excepsSize) {
	  excepsSize = (SafeInt(widths.nExceps) + SafeInt(obj3.arrayGetLength()) + 15).Int() & ~15;
	  widths.exceps = (GfxFontCIDWidthExcep *)
	    greallocn(widths.exceps,
		      excepsSize, sizeof(GfxFontCIDWidthExcep));

    excepsSize = 0;
    i = 0;
    while (i + 1 < obj1.arrayGetLength()) {
      obj1.arrayGet(i.Int(), &obj2);
      obj1.arrayGet((i+ 1).Int(), &obj3);
      if (obj2.isInt() && obj3.isInt() && (i + 4).Int() < obj1.arrayGetLength()) {
	if (obj1.arrayGet((i + 2).Int(), &obj4)->isNum() &&
	    obj1.arrayGet((i + 3).Int(), &obj5)->isNum() &&
	    obj1.arrayGet((i + 4).Int(), &obj6)->isNum()) {
	  if (widths.nExcepsV == excepsSize) {
	    excepsSize += 16;
	    widths.excepsV = (GfxFontCIDWidthExcepV *)




  GBool *curve;			// curve[i] => point i is a control point
				//   for a Bezier curve
  int n;			// number of points
  SafeInt size;			// size of x/y arrays
  GBool closed;			// set if path is closed

  GfxSubpath(GfxSubpath *subpath);

  GBool isPath() { return n > 0; }

  // Get subpaths.
  int getNumSubpaths() { return n.Int(); }
  GfxSubpath *getSubpath(int i) { return subpaths[i]; }

  // Get last point on last subpath.
  double getLastX() { return subpaths[n.Int()-1]->getLastX(); }
  double getLastY() { return subpaths[n.Int()-1]->getLastY(); }

  // Move the current point.
  void moveTo(double x, double y);

  GBool justMoved;		// set if a new subpath was just started
  double firstX, firstY;	// first point in new subpath
  GfxSubpath **subpaths;	// subpaths
  SafeInt n;			// number of subpaths
  SafeInt size;			// size of subpaths array

  GfxPath(GBool justMoved1, double firstX1, double firstY1,
	  GfxSubpath **subpaths1, SafeInt n1, SafeInt size1);
};

//------------------------------------------------------------------------




					   int indexHighA) {
  base = baseA;
  indexHigh = indexHighA;
  lookup = (Guchar *)gmallocn((SafeInt(indexHigh) + SafeInt(1)) * SafeInt(base->getNComps()),
			      sizeof(Guchar));
}


  vertices = (GfxGouraudVertex *)gmallocn(nVertices, sizeof(GfxGouraudVertex));
  memcpy(vertices, shading->vertices, nVertices * sizeof(GfxGouraudVertex));
  nTriangles = shading->nTriangles;
  triangles = (int (*)[3])gmallocn(SafeInt(nTriangles) * SafeInt(3), sizeof(int));
  memcpy(triangles, shading->triangles, nTriangles * 3 * sizeof(int));
  nFuncs = shading->nFuncs;
  for (i = 0; i < nFuncs; ++i) {

  double cMul[gfxColorMaxComps];
  GfxGouraudVertex *verticesA;
  int (*trianglesA)[3];
  int nComps, nVerticesA, nTrianglesA;
  SafeInt vertSize, triSize;
  Guint x, y, flag;
  Guint c[gfxColorMaxComps];
  GfxShadingBitBuf *bitBuf;

      break;
    }
    if (nVerticesA == vertSize) {
      SafeInt oldVertSize = vertSize;
      vertSize = (vertSize == 0) ? 16 : 2 * vertSize;
      verticesA = (GfxGouraudVertex *)
	              greallocn(verticesA, vertSize, sizeof(GfxGouraudVertex));
      memset(verticesA + oldVertSize.Int(), 0, (vertSize - oldVertSize).Int() * sizeof(GfxGouraudVertex));
    }
    verticesA[nVerticesA].x = xMin + xMul * (double)x;
    verticesA[nVerticesA].y = yMin + yMul * (double)y;

	if (nTrianglesA == triSize) {
	  triSize = (triSize == 0) ? 16 : 2 * triSize;
	  trianglesA = (int (*)[3])
	                   greallocn(trianglesA, SafeInt(triSize) * SafeInt(3), sizeof(int));
	}
	if (state == 2) {
	  trianglesA[nTrianglesA][0] = nVerticesA - 3;

  delete bitBuf;
  if (typeA == 5) {
    nRows = nVerticesA / vertsPerRow;
    nTrianglesA = ((SafeInt(nRows) - SafeInt(1)) * SafeInt(2)
		                   * (SafeInt(vertsPerRow) - SafeInt(1))).Int();
    trianglesA = (int (*)[3])gmallocn(SafeInt(nTrianglesA) * SafeInt(3), sizeof(int));
    k = 0;
    for (i = 0; i < nRows - 1; ++i) {
      for (j = 0; j < vertsPerRow - 1; ++j) {

  double xMul, yMul;
  double cMul[gfxColorMaxComps];
  GfxPatch *patchesA, *p;
  int nComps, nPatchesA, nPts, nColors;
  SafeInt patchesSize;
  Guint flag;
  double x[16], y[16];
  Guint xi, yi;

      break;
    }
    if (nPatchesA == patchesSize) {
      SafeInt oldPatchesSize = patchesSize;
      patchesSize = (patchesSize == 0) ? 16 : 2 * patchesSize;
      patchesA = (GfxPatch *)greallocn(patchesA,
				       patchesSize, sizeof(GfxPatch));
      memset(patchesA + oldPatchesSize.Int(), 0, (patchesSize - oldPatchesSize).Int() * sizeof(GfxPatch));
    }
    p = &patchesA[nPatchesA];
    if (typeA == 6) {

      useByteLookup = gTrue;
    }
    for (k = 0; k < nComps2; ++k) {
      lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1),
					   sizeof(GfxColorComp));
      for (i = 0; i <= maxPixel; ++i) {
	j = (int)(decodeLow[0] + (i * decodeRange[0]) / maxPixel + 0.5);

    nComps2 = colorSpace2->getNComps();
    sepFunc = sepCS->getFunc();
    if (colorSpace2->useGetGrayLine() || colorSpace2->useGetRGBLine()) {
      byte_lookup = (Guchar *)gmallocn ((SafeInt(maxPixel) + SafeInt(1)), nComps2);
      useByteLookup = gTrue;
    }
    for (k = 0; k < nComps2; ++k) {
      lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1),
					   sizeof(GfxColorComp));
      for (i = 0; i <= maxPixel; ++i) {
	x[0] = decodeLow[0] + (i * decodeRange[0]) / maxPixel;

    break;
  default:
    if (colorSpace->useGetGrayLine() || colorSpace->useGetRGBLine()) {
      byte_lookup = (Guchar *)gmallocn ((SafeInt(maxPixel) + SafeInt(1)), nComps);
      useByteLookup = gTrue;
    }
    for (k = 0; k < nComps; ++k) {
      lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1),
					   sizeof(GfxColorComp));
      for (i = 0; i <= maxPixel; ++i) {
	mapped = decodeLow[k] + (i * decodeRange[k]) / maxPixel;

}

GfxImageColorMap::GfxImageColorMap(GfxImageColorMap *colorMap) {
  int i, k;
  SafeInt n;

  colorSpace = colorMap->colorSpace->copy();
  bits = colorMap->bits;

    colorSpace2 = ((GfxIndexedColorSpace *)colorSpace)->getBase();
    for (k = 0; k < nComps2; ++k) {
      lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));
      memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp));
    }
  } else if (colorSpace->getMode() == csSeparation) {
    colorSpace2 = ((GfxSeparationColorSpace *)colorSpace)->getAlt();
    for (k = 0; k < nComps2; ++k) {
      lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));
      memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp));
    }
  } else {
    for (k = 0; k < nComps; ++k) {
      lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));
      memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp));
    }
  }
  if (colorMap->byte_lookup) {
    int nc = colorSpace2 ? nComps2 : nComps;

    byte_lookup = (Guchar *)gmallocn (n, nc);
    memcpy(byte_lookup, colorMap->byte_lookup, n.Int() * nc);
  }
  for (i = 0; i < nComps; ++i) {
    decodeLow[i] = colorMap->decodeLow[i];


// Used for copy().
GfxPath::GfxPath(GBool justMoved1, double firstX1, double firstY1,
		 GfxSubpath **subpaths1, SafeInt n1, SafeInt size1) {
  int i;

  justMoved = justMoved1;

      subpaths = (GfxSubpath **)
	           greallocn(subpaths, size, sizeof(GfxSubpath *));
    }
    subpaths[n.Int()] = new GfxSubpath(firstX, firstY);
    ++n;
    justMoved = gFalse;
  }
  subpaths[n.Int()-1]->lineTo(x, y);
}

void GfxPath::curveTo(double x1, double y1, double x2, double y2,

      subpaths = (GfxSubpath **) 
 	         greallocn(subpaths, size, sizeof(GfxSubpath *));
    }
    subpaths[n.Int()] = new GfxSubpath(firstX, firstY);
    ++n;
    justMoved = gFalse;
  }
  subpaths[n.Int()-1]->curveTo(x1, y1, x2, y2, x3, y3);
}

void GfxPath::close() {

      subpaths = (GfxSubpath **)
	greallocn(subpaths, size, sizeof(GfxSubpath *));
    }
    subpaths[n.Int()] = new GfxSubpath(firstX, firstY);
    ++n;
    justMoved = gFalse;
  }
  subpaths[n.Int()-1]->close();
}

void GfxPath::append(GfxPath *path) {

                 greallocn(subpaths, size, sizeof(GfxSubpath *));
  }
  for (i = 0; i < path->n; ++i) {
    subpaths[(n++).Int()] = path->subpaths[i]->copy();
  }
  justMoved = gFalse;
}

Lines 48-54 Link Here

(-)poppler-0.12.0/utils/ImageOutputDev.cc (-1 / +1 lines)
48		48
49	ImageOutputDev::ImageOutputDev(char *fileRootA, GBool dumpJPEGA) {	49	ImageOutputDev::ImageOutputDev(char *fileRootA, GBool dumpJPEGA) {
50	fileRoot = copyString(fileRootA);	50	fileRoot = copyString(fileRootA);
51	fileName = (char *)gmalloc(strlen(fileRoot) + 20);	51	fileName = (char *)gmalloc((SafeInt(strlen(fileRoot)) + SafeInt(20)).Int());
52	dumpJPEG = dumpJPEGA;	52	dumpJPEG = dumpJPEGA;
53	imgNum = 0;	53	imgNum = 0;
54	ok = gTrue;	54	ok = gTrue;

Lines 7-12 Link Here

(-)poppler-0.12.0/poppler/JArithmeticDecoder.cc (+5 lines)
7	//========================================================================	7	//========================================================================
8		8
9	#include <config.h>	9	#include <config.h>
		10	#include <stdlib.h>
10		11
11	#ifdef USE_GCC_PRAGMAS	12	#ifdef USE_GCC_PRAGMAS
12	#pragma implementation	13	#pragma implementation
Lines 47-52 void JArithmeticDecoderStats::copyFrom(J Link Here
47	}	48	}
48		49
49	void JArithmeticDecoderStats::setEntry(Guint cx, int i, int mps) {	50	void JArithmeticDecoderStats::setEntry(Guint cx, int i, int mps) {
		51	if (cx >= contextSize) {
		52	fprintf(stderr, "index out of bounds");
		53	exit(1);
		54	}
50	cxTab[cx] = (i << 1) + mps;	55	cxTab[cx] = (i << 1) + mps;
51	}	56	}
52		57




{
  w = wA;
  h = hA;
  line = (SafeInt(wA) + SafeInt(7) >> 3).Int();

  if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
    error(-1, "invalid width/height");

  }

  // get the input symbol bitmaps
  bitmaps = (JBIG2Bitmap **)gmallocn(SafeInt(numInputSyms) + SafeInt(numNewSyms),
				     sizeof(JBIG2Bitmap *));
  for (i = 0; i < numInputSyms + numNewSyms; ++i) {
    bitmaps[i] = NULL;

  int sOffset;
  Guint huffFlags, huffFS, huffDS, huffDT;
  Guint huffRDW, huffRDH, huffRDX, huffRDY, huffRSize;
  Guint numInstances, symCodeLen;
  SafeInt numSyms;
  int atx[2], aty[2];
  Guint i, k, kk;
  int j;

    runLengthTab[35].prefixLen = 0;
    runLengthTab[35].rangeLen = jbig2HuffmanEOT;
    huffDecoder->buildTable(runLengthTab, 35);
    symCodeTab = (JBIG2HuffmanTable *)gmallocn(numSyms + SafeInt(1),
					       sizeof(JBIG2HuffmanTable));
    for (i = 0; i < numSyms; ++i) {
      symCodeTab[i].val = i;

	symCodeTab[i++].prefixLen = j;
      }
    }
    symCodeTab[numSyms.Int()].prefixLen = 0;
    symCodeTab[numSyms.Int()].rangeLen = jbig2HuffmanEOT;
    huffDecoder->buildTable(symCodeTab, numSyms.Int());
    huffDecoder->reset();

  // set up the arithmetic decoder

  }

  bitmap = readTextRegion(huff, refine, w, h, numInstances,
			  logStrips, numSyms.Int(), symCodeTab, symCodeLen, syms,
			  defPixel, combOp, transposed, refCorner, sOffset,
			  huffFSTable, huffDSTable, huffDTTable,
			  huffRDWTable, huffRDHTable,

      error(curStr->getPos(), "Bad width in JBIG2 generic bitmap");
      // force a call to gmalloc(-1), which will throw an exception
      w = -3;
      gmallocn(w + 2, sizeof(int));
    }
    // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = w
    // ---> max codingLine size = w + 1

  val = lowVal;
  while (val < highVal) {
    if (i == huffTabSize) {
      huffTabSize = (SafeInt(huffTabSize) * 2).Int();
      huffTab = (JBIG2HuffmanTable *)
	            greallocn(huffTab, huffTabSize, sizeof(JBIG2HuffmanTable));
    }




      }
      palette.bpc = (Guint *)gmallocn(palette.nComps, sizeof(Guint));
      palette.c =
          (int *)gmallocn(SafeInt(palette.nEntries) * SafeInt(palette.nComps), sizeof(int));
      for (i = 0; i < palette.nComps; ++i) {
	if (!readUByte(&palette.bpc[i])) {
	  error(getPos(), "Unexpected EOF in JPX stream");

	error(getPos(), "Bad tile count in JPX SIZ marker segment");
	return gFalse;
      }
      img.tiles = (JPXTile *)gmallocn(SafeInt(img.nXTiles) * SafeInt(img.nYTiles),
				      sizeof(JPXTile));
      for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,

	  }
	  img.tiles[i].tileComps[comp].resLevels =
	      (JPXResLevel *)gmallocn(
		     (SafeInt(img.tiles[i].tileComps[comp].nDecompLevels) + SafeInt(1)),
		     sizeof(JPXResLevel));
	  for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) {
	    img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL;

	img.tiles[i].tileComps[comp].resLevels =
	    (JPXResLevel *)greallocn(
		     img.tiles[i].tileComps[comp].resLevels,
		     (SafeInt(img.tiles[i].tileComps[comp].nDecompLevels) + SafeInt(1)),
		     sizeof(JPXResLevel));
	for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) {
	  img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL;

	img.tiles[tileIdx].tileComps[comp].resLevels =
	    (JPXResLevel *)greallocn(
		     img.tiles[tileIdx].tileComps[comp].resLevels,
		     (SafeInt(img.tiles[tileIdx].tileComps[comp].nDecompLevels) + SafeInt(1)),
		     sizeof(JPXResLevel));
	for (r = 0;
	     r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels;

      img.tiles[tileIdx].tileComps[comp].resLevels =
	  (JPXResLevel *)greallocn(
		     img.tiles[tileIdx].tileComps[comp].resLevels,
		     (SafeInt(img.tiles[tileIdx].tileComps[comp].nDecompLevels) + SafeInt(1)),
		     sizeof(JPXResLevel));
      for (r = 0; r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels; ++r) {
	img.tiles[tileIdx].tileComps[comp].resLevels[r].precincts = NULL;

      tileComp->y1 = jpxCeilDiv(tile->y1, tileComp->hSep);
      tileComp->cbW = 1 << tileComp->codeBlockW;
      tileComp->cbH = 1 << tileComp->codeBlockH;
      tileComp->data = (int *)gmallocn((SafeInt(tileComp->x1) - SafeInt(tileComp->x0)) *
				       (SafeInt(tileComp->y1) - SafeInt(tileComp->y0)),
				       sizeof(int));
      if (tileComp->x1 - tileComp->x0 > tileComp->y1 - tileComp->y0) {
	n = tileComp->x1 - tileComp->x0;
      } else {
	n = tileComp->y1 - tileComp->y0;
      }
      tileComp->buf = (int *)gmallocn(SafeInt(n) + SafeInt(8), sizeof(int));
      for (r = 0; r <= tileComp->nDecompLevels; ++r) {
	resLevel = &tileComp->resLevels[r];
	k = r == 0 ? tileComp->nDecompLevels

	    for (level = subband->maxTTLevel; level >= 0; --level) {
	      nx = jpxCeilDivPow2(subband->nXCBs, level);
	      ny = jpxCeilDivPow2(subband->nYCBs, level);
	      n += (SafeInt(nx) * SafeInt(ny)).Int();
	    }
	    subband->inclusion =
	        (JPXTagTreeNode *)gmallocn(n, sizeof(JPXTagTreeNode));

	      subband->zeroBitPlane[k].finished = gFalse;
	      subband->zeroBitPlane[k].val = 0;
	    }
	    subband->cbs = (JPXCodeBlock *)gmallocn(SafeInt(subband->nXCBs) *
						      SafeInt(subband->nYCBs),
						    sizeof(JPXCodeBlock));
	    sbx0 = jpxFloorDivPow2(subband->x0, tileComp->codeBlockW);
	    sby0 = jpxFloorDivPow2(subband->y0, tileComp->codeBlockH);

		cb->nextPass = jpxPassCleanup;
		cb->nZeroBitPlanes = 0;
		cb->coeffs =
		    (JPXCoeff *)gmallocn((SafeInt(1) << (SafeInt(tileComp->codeBlockW)
						+ SafeInt(tileComp->codeBlockH)).Int()),
					 sizeof(JPXCoeff));
		for (cbi = 0;
		     cbi < (Guint)(1 << (tileComp->codeBlockW

Lines 861-867 Link::~Link() { Link Here

(-)poppler-0.12.0/poppler/Link.cc (-1 / +1 lines)
861	Links::Links(Object annots, GooString baseURI) {	861	Links::Links(Object annots, GooString baseURI) {
862	Link *link;	862	Link *link;
863	Object obj1, obj2;	863	Object obj1, obj2;
864	int size;	864	SafeInt size;
865	int i;	865	int i;
866		866
867	links = NULL;	867	links = NULL;

Lines 49-55 NameToCharCode::~NameToCharCode() { Link Here

(-)poppler-0.12.0/poppler/NameToCharCode.cc (-2 / +3 lines)
49		49
50	void NameToCharCode::add(char *name, CharCode c) {	50	void NameToCharCode::add(char *name, CharCode c) {
51	NameToCharCodeEntry *oldTab;	51	NameToCharCodeEntry *oldTab;
52	int h, i, oldSize;	52	int h, i;
		53	SafeInt oldSize;
53		54
54	// expand the table if necessary	55	// expand the table if necessary
55	if (len >= size / 2) {	56	if (len >= size / 2) {
Lines 112-116 int NameToCharCode::hash(char *name) { Link Here
112	for (p = name; *p; ++p) {	113	for (p = name; *p; ++p) {
113	h = 17 * h + (int)(*p & 0xff);	114	h = 17 * h + (int)(*p & 0xff);
114	}	115	}
115	return (int)(h % size);	116	return (int)(h % size.Int());
116	}	117	}

Lines 33-39 private: Link Here

(-)poppler-0.12.0/poppler/NameToCharCode.h (-1 / +1 lines)
33	int hash(char *name);	33	int hash(char *name);
34		34
35	NameToCharCodeEntry *tab;	35	NameToCharCodeEntry *tab;
36	int size;	36	SafeInt size;
37	int len;	37	int len;
38	};	38	};
39		39




    if (fontFileNameLen >= fontFileNameSize) {
      fontFileNameSize += 64;
      fontFileNames =
	(GooString **)greallocn(fontFileNames,
			     fontFileNameSize, sizeof(GooString *));
      psFileNames =
	(GooString **)greallocn(psFileNames,
			     fontFileNameSize, sizeof(GooString *));
    }
  }
  fontFileNames[fontFileNameLen] = myFileName;

  ImageStream *imgStr;
  Guchar *line;
  PSOutImgClipRect *rects0, *rects1, *rectsTmp, *rectsOut;
  int rects0Len, rects1Len, rectsOutLen;
  SafeInt rectsOutSize, rectsSize;
  GBool emitRect, addRect, extendRect;
  GooString *s;
  int n, numComps;





  Ref *fontIDs;			// list of object IDs of all used fonts
  int fontIDLen;		// number of entries in fontIDs array
  SafeInt fontIDSize;		// size of fontIDs array
  Ref *fontFileIDs;		// list of object IDs of all embedded fonts
  int fontFileIDLen;		// number of entries in fontFileIDs array
  SafeInt fontFileIDSize;		// size of fontFileIDs array
  GooString **fontFileNames;	// list of names of all embedded external fonts
  GooString **psFileNames;	// list of names of all embedded external fonts
  int fontFileNameLen;		// number of entries in fontFileNames array

				//   font name
  PSFont8Info *font8Info;	// info for 8-bit fonts
  int font8InfoLen;		// number of entries in font8Info array
  SafeInt font8InfoSize;		// size of font8Info array
  PSFont16Enc *font16Enc;	// encodings for substitute 16-bit fonts
  int font16EncLen;		// number of entries in font16Enc array
  SafeInt font16EncSize;		// size of font16Enc array
  Ref *imgIDs;			// list of image IDs for in-memory images
  int imgIDLen;			// number of entries in imgIDs array
  SafeInt imgIDSize;		// size of imgIDs array
  Ref *formIDs;			// list of IDs for predefined forms
  int formIDLen;		// number of entries in formIDs array
  SafeInt formIDSize;		// size of formIDs array
  GooList *xobjStack;		// stack of XObject dicts currently being
				//   processed
  int numSaves;			// current number of gsaves




  int glyphW, glyphH;		// size of glyph bitmaps, in pixels
  GBool validBBox;		// false if the bbox was [0 0 0 0]
  int glyphSize;		// size of glyph bitmaps, in bytes
  SafeInt cacheSets;		// number of sets in cache
  SafeInt cacheAssoc;		// cache associativity (glyphs per set)
  Guchar *cacheData;		// glyph pixmap cache
  T3FontCacheTag *cacheTags;	// cache tags, i.e., char codes
};

    cacheTags = (T3FontCacheTag *)gmallocn(cacheSets * cacheAssoc,
					 sizeof(T3FontCacheTag));
    for (i = 0; i < cacheSets * cacheAssoc; ++i) {
      cacheTags[i].mru = i & (cacheAssoc.Int() - 1);
    }
  }
  else

  t3Font = t3FontCache[0];

  // is the glyph in the cache?
  i = (code & (t3Font->cacheSets.Int() - 1)) * t3Font->cacheAssoc.Int();
  for (j = 0; j < t3Font->cacheAssoc; ++j) {
    if (t3Font->cacheTags != NULL) {
      if ((t3Font->cacheTags[i+j].mru & 0x8000) &&

    return;

  // allocate a cache entry
  i = (t3GlyphStack->code & (t3Font->cacheSets.Int() - 1)) * t3Font->cacheAssoc.Int();
  for (j = 0; j < t3Font->cacheAssoc; ++j) {
    if ((t3Font->cacheTags[i+j].mru & 0x7fff) == t3Font->cacheAssoc - 1) {
      t3Font->cacheTags[i+j].mru = 0x8000;

  // build a lookup table here
  imgData.lookup = NULL;
  if (colorMap->getNumPixelComps() == 1) {
    n = (SafeInt(1) << colorMap->getBits()).Int();
    switch (colorMode) {
    case splashModeMono1:
    case splashModeMono8:

    // build a lookup table here
    imgData.lookup = NULL;
    if (colorMap->getNumPixelComps() == 1) {
      n = (SafeInt(1) << colorMap->getBits()).Int();
      switch (colorMode) {
      case splashModeMono1:
      case splashModeMono8:

  imgMaskData.width = maskWidth;
  imgMaskData.height = maskHeight;
  imgMaskData.y = 0;
  n = (SafeInt(1) << maskColorMap->getBits()).Int();
  imgMaskData.lookup = (SplashColorPtr)gmalloc(n);
  for (i = 0; i < n; ++i) {
    pix = (Guchar)i;

  // build a lookup table here
  imgData.lookup = NULL;
  if (colorMap->getNumPixelComps() == 1) {
    n = (SafeInt(1) << maskColorMap->getBits()).Int();
    switch (colorMode) {
    case splashModeMono1:
    case splashModeMono8:





  nVals = width * nComps;
  if (nBits == 1) {
    imgLineSize = (SafeInt(nVals) + SafeInt(7)).Int() & ~7;
  } else {
    imgLineSize = nVals;
  }

  // ---> max codingLine size = columns + 1
  // refLine has one extra guard entry at the end
  // ---> max refLine size = columns + 2
  codingLine = (int *)gmallocn_checkoverflow(SafeInt(columns) + SafeInt(1), sizeof(int));
  refLine = (int *)gmallocn_checkoverflow(SafeInt(columns) + SafeInt(2), sizeof(int));

  if (codingLine != NULL && refLine != NULL) {
    eof = gFalse;

  unfilteredReset();

  if (!readHeader()) {
    y = height.Int();
    return;
  }


    if (bufWidth <= 0 || bufHeight <= 0 ||
	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
      error(getPos(), "Invalid image size in DCT stream");
      y = height.Int();
      return;
    }
    for (i = 0; i < numComps; ++i) {
      frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
      memset(frameBuf[i], 0, (bufWidth * bufHeight * sizeof(int)).Int());
    }

    // read the image data

    comp = 0;
    x = 0;
    y = 0;
    dy = mcuHeight.Int();

    restartMarker = 0xd0;
    restart();

    return EOF;
  }
  if (progressive || !interleaved) {
    c = frameBuf[comp][y * bufWidth.Int() + x];
    if (++comp == numComps) {
      comp = 0;
      if (++x == width) {

  } else {
    if (dy >= mcuHeight) {
      if (!readMCURow()) {
	y = height.Int();
	return EOF;
      }
      comp = 0;

    return EOF;
  }
  if (progressive || !interleaved) {
    return frameBuf[comp][y * bufWidth.Int() + x];
  } else {
    if (dy >= mcuHeight) {
      if (!readMCURow()) {
	y = height.Int();
	return EOF;
      }
      comp = 0;

  int x1, x2, y2, x3, y3, x4, y4, x5, y5, cc, i;
  int c;

  for (x1 = 0; x1 < width; x1 += mcuWidth.Int()) {

    // deal with restart marker
    if (restartInterval > 0 && restartCtr == 0) {

    for (cc = 0; cc < numComps; ++cc) {
      h = compInfo[cc].hSample;
      v = compInfo[cc].vSample;
      horiz = mcuWidth.Int() / h;
      vert = mcuHeight.Int() / v;
      hSub = horiz / 8;
      vSub = vert / 8;
      for (y2 = 0; y2 < mcuHeight; y2 += vert) {

	break;
      }
    }
    dx1 = mcuWidth.Int() / compInfo[cc].hSample;
    dy1 = mcuHeight.Int() / compInfo[cc].vSample;
  } else {
    dx1 = mcuWidth.Int();
    dy1 = mcuHeight.Int();
  }

  for (y1 = 0; y1 < height; y1 += dy1) {


	h = compInfo[cc].hSample;
	v = compInfo[cc].vSample;
	horiz = mcuWidth.Int() / h;
	vert = mcuHeight.Int() / v;
	vSub = vert / 8;
	for (y2 = 0; y2 < dy1; y2 += vert) {
	  for (x2 = 0; x2 < dx1; x2 += horiz) {

	    // pull out the current values
	    p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
	    for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
	      data[i] = p1[0];
	      data[i+1] = p1[1];

	      data[i+5] = p1[5];
	      data[i+6] = p1[6];
	      data[i+7] = p1[7];
	      p1 += bufWidth.Int() * vSub;
	    }

	    // read one data unit

	    }

	    // add the data unit into frameBuf
	    p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
	    for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
	      p1[0] = data[i];
	      p1[1] = data[i+1];

	      p1[5] = data[i+5];
	      p1[6] = data[i+6];
	      p1[7] = data[i+7];
	      p1 += bufWidth.Int() * vSub;
	    }
	  }
	}

  int h, v, horiz, vert, hSub, vSub;
  int *p0, *p1, *p2;

  for (y1 = 0; y1 < bufHeight; y1 += mcuHeight.Int()) {
    for (x1 = 0; x1 < bufWidth; x1 += mcuWidth.Int()) {
      for (cc = 0; cc < numComps; ++cc) {
	quantTable = quantTables[compInfo[cc].quantTable];
	h = compInfo[cc].hSample;
	v = compInfo[cc].vSample;
	horiz = mcuWidth.Int() / h;
	vert = mcuHeight.Int() / v;
	hSub = horiz / 8;
	vSub = vert / 8;
	for (y2 = 0; y2 < mcuHeight; y2 += vert) {
	  for (x2 = 0; x2 < mcuWidth; x2 += horiz) {

	    // pull out the coded data unit
	    p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
	    for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
	      dataIn[i]   = p1[0];
	      dataIn[i+1] = p1[1];

	      dataIn[i+5] = p1[5];
	      dataIn[i+6] = p1[6];
	      dataIn[i+7] = p1[7];
	      p1 += bufWidth.Int() * vSub;
	    }

	    // transform


	    // store back into frameBuf, doing replication for
	    // subsampled components
	    p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
	    if (hSub == 1 && vSub == 1) {
	      for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
		p1[0] = dataOut[i] & 0xff;

		p1[5] = dataOut[i+5] & 0xff;
		p1[6] = dataOut[i+6] & 0xff;
		p1[7] = dataOut[i+7] & 0xff;
		p1 += bufWidth.Int();
	      }
	    } else if (hSub == 2 && vSub == 2) {
	      p2 = p1 + bufWidth.Int();
	      for (y3 = 0, i = 0; y3 < 16; y3 += 2, i += 8) {
		p1[0] = p1[1] = p2[0] = p2[1] = dataOut[i] & 0xff;
		p1[2] = p1[3] = p2[2] = p2[3] = dataOut[i+1] & 0xff;

		p1[10] = p1[11] = p2[10] = p2[11] = dataOut[i+5] & 0xff;
		p1[12] = p1[13] = p2[12] = p2[13] = dataOut[i+6] & 0xff;
		p1[14] = p1[15] = p2[14] = p2[15] = dataOut[i+7] & 0xff;
		p1 += bufWidth.Int() * 2;
		p2 += bufWidth.Int() * 2;
	      }
	    } else {
	      i = 0;

		    for (x5 = 0; x5 < hSub; ++x5) {
		      p2[x5] = dataOut[i] & 0xff;
		    }
		    p2 += bufWidth.Int();
		  }
		  ++i;
		}
		p1 += bufWidth.Int() * vSub;
	      }
	    }
	  }

	// convert YCbCr to RGB
	if (numComps == 3) {
	  for (y2 = 0; y2 < mcuHeight; ++y2) {
	    p0 = &frameBuf[0][(y1+y2) * bufWidth.Int() + x1];
	    p1 = &frameBuf[1][(y1+y2) * bufWidth.Int() + x1];
	    p2 = &frameBuf[2][(y1+y2) * bufWidth.Int() + x1];
	    for (x2 = 0; x2 < mcuWidth; ++x2) {
	      pY = *p0;
	      pCb = *p1 - 128;

	// convert YCbCrK to CMYK (K is passed through unchanged)
	} else if (numComps == 4) {
	  for (y2 = 0; y2 < mcuHeight; ++y2) {
	    p0 = &frameBuf[0][(y1+y2) * bufWidth.Int() + x1];
	    p1 = &frameBuf[1][(y1+y2) * bufWidth.Int() + x1];
	    p2 = &frameBuf[2][(y1+y2) * bufWidth.Int() + x1];
	    for (x2 = 0; x2 < mcuWidth; ++x2) {
	      pY = *p0;
	      pCb = *p1 - 128;

  }

  // allocate the table
  tabSize = (SafeInt(1) << tab->maxLen).Int();
  tab->codes = (FlateCode *)gmallocn(tabSize, sizeof(FlateCode));

  // clear the table

Lines 699-707 private: Link Here

(-)poppler-0.12.0/poppler/Stream.h (-3 / +3 lines)
699		699
700	GBool progressive; // set if in progressive mode	700	GBool progressive; // set if in progressive mode
701	GBool interleaved; // set if in interleaved mode	701	GBool interleaved; // set if in interleaved mode
702	int width, height; // image size	702	SafeInt width, height; // image size
703	int mcuWidth, mcuHeight; // size of min coding unit, in data units	703	SafeInt mcuWidth, mcuHeight; // size of min coding unit, in data units
704	int bufWidth, bufHeight; // frameBuf size	704	SafeInt bufWidth, bufHeight; // frameBuf size
705	DCTCompInfo compInfo[4]; // info for each component	705	DCTCompInfo compInfo[4]; // info for each component
706	DCTScanInfo scanInfo; // info for the current scan	706	DCTScanInfo scanInfo; // info for the current scan
707	int numComps; // number of components in image	707	int numComps; // number of components in image




  text = NULL;
  charcode = NULL;
  edge = NULL;
  size = len = 0;
  spaceAfter = gFalse;
  next = NULL;


    yMax = word->yMax;
  }
  if (len + word->len > size) {
    size = SafeInt(len) + SafeInt(word->len);
    text = (Unicode *)greallocn(text, size, sizeof(Unicode));
    charcode = (CharCode *)greallocn(charcode, (size + 1), sizeof(CharCode));
    edge = (double *)greallocn(edge, (size + SafeInt(1)), sizeof(double));
  }
  for (i = 0; i < word->len; ++i) {
    text[len + i] = word->text[i];

}

TextPool::~TextPool() {
  SafeInt baseIdx;
  TextWord *word, *word2;

  for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) {
    for (word = pool[(baseIdx - minBaseIdx).Int()]; word; word = word2) {
      word2 = word->next;
      delete word;
    }


  baseIdx = (int)(base / textPoolStep);
  if (baseIdx < minBaseIdx) {
    return minBaseIdx.Int();
  }
  if (baseIdx > maxBaseIdx) {
    return maxBaseIdx.Int();
  }
  return baseIdx;
}

void TextPool::addWord(TextWord *word) {
  TextWord **newPool;
  SafeInt wordBaseIdx, newMinBaseIdx, newMaxBaseIdx, baseIdx;
  TextWord *w0, *w1;

  // expand the array if needed

  if (minBaseIdx > maxBaseIdx) {
    minBaseIdx = wordBaseIdx - 128;
    maxBaseIdx = wordBaseIdx + 128;
    pool = (TextWord **)gmallocn(maxBaseIdx - minBaseIdx + SafeInt(1),
				 sizeof(TextWord *));
    for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) {
      pool[(baseIdx - minBaseIdx).Int()] = NULL;
    }
  } else if (wordBaseIdx < minBaseIdx) {
    newMinBaseIdx = wordBaseIdx - 128;
    newPool = (TextWord **)gmallocn(maxBaseIdx - newMinBaseIdx + SafeInt(1),
				    sizeof(TextWord *));
    for (baseIdx = newMinBaseIdx; baseIdx < minBaseIdx; ++baseIdx) {
      newPool[(baseIdx - newMinBaseIdx).Int()] = NULL;
    }
    memcpy(&newPool[(minBaseIdx - newMinBaseIdx).Int()], pool,
	   ((maxBaseIdx - minBaseIdx + 1) * sizeof(TextWord *)).Int());
    gfree(pool);
    pool = newPool;
    minBaseIdx = newMinBaseIdx;
  } else if (wordBaseIdx > maxBaseIdx) {
    newMaxBaseIdx = wordBaseIdx + 128;
    pool = (TextWord **)greallocn(pool, newMaxBaseIdx - minBaseIdx + SafeInt(1),
				  sizeof(TextWord *));
    for (baseIdx = maxBaseIdx + 1; baseIdx <= newMaxBaseIdx; ++baseIdx) {
      pool[(baseIdx - minBaseIdx).Int()] = NULL;
    }
    maxBaseIdx = newMaxBaseIdx;
  }

    w1 = cursor->next;
  } else {
    w0 = NULL;
    w1 = pool[(wordBaseIdx - minBaseIdx).Int()];
  }
  for (; w1 && word->primaryCmp(w1) > 0; w0 = w1, w1 = w1->next) ;
  word->next = w1;
  if (w0) {
    w0->next = word;
  } else {
    pool[(wordBaseIdx - minBaseIdx).Int()] = word;
  }
  cursor = word;
  cursorBaseIdx = wordBaseIdx.Int();
}

//------------------------------------------------------------------------

    }
  }
  text = (Unicode *)gmallocn(len, sizeof(Unicode));
  edge = (double *)gmallocn(len + SafeInt(1), sizeof(double));
  i = 0;
  for (word1 = words; word1; word1 = word1->next) {
    for (j = 0; j < word1->len; ++j) {

  }

  // compute convertedLen and set up the col array
  col = (int *)gmallocn(len + SafeInt(1), sizeof(int));
  convertedLen = 0;
  for (i = 0; i < len; ++i) {
    col[i] = convertedLen;

      convertedLen += uMap->mapUnicode(text[i], buf, sizeof(buf));
    }
  }
  col[len.Int()] = convertedLen;

  // check for hyphen at end of line
  //~ need to check for other chars used as hyphens
  hyphenated = text[(len - 1).Int()] == (Unicode)'-';
}

//------------------------------------------------------------------------

  int i, j, k;

  // discard duplicated text (fake boldface, drop shadows)
  for (idx0 = pool->minBaseIdx.Int(); idx0 <= pool->maxBaseIdx.Int(); ++idx0) {
    word0 = pool->getPool(idx0);
    while (word0) {
      priDelta = dupMaxPriDelta * word0->fontSize;


  // build the lines
  curLine = NULL;
  poolMinBaseIdx = pool->minBaseIdx.Int();
  charCount = 0;
  nLines = 0;
  while (1) {

    line->next = line1;
    curLine = line;
    line->coalesce(uMap);
    charCount += line->len.Int();
    ++nLines;
  }


  for (line = lines, i = 0; line; line = line->next, ++i) {
    lineArray[i] = line;
  }
  qsort(lineArray, nLines.Int(), sizeof(TextLine *), &TextLine::cmpXY);

  // column assignment
  nColumns = 0;

    for (j = 0; j < i; ++j) {
      line1 = lineArray[j];
      if (line1->primaryDelta(line0) >= 0) {
	col2 = line1->col[line1->len.Int()] + 1;
      } else {
	k = 0; // make gcc happy
	switch (rot) {

    for (k = 0; k <= line0->len; ++k) {
      line0->col[k] += col1;
    }
    if (line0->col[line0->len.Int()] > nColumns) {
      nColumns = line0->col[line0->len.Int()];
    }
  }
  gfree(lineArray);

  TextLine *line;
  TextWord *word;
  TextWord **wordArray;
  SafeInt nWords;
  int i;

  words = new GooList();


	}
      }
    }
    qsort(wordArray, nWords.Int(), sizeof(TextWord *), &TextWord::cmpYX);
    for (i = 0; i < nWords; ++i) {
      words->append(wordArray[i]);
    }

  GBool found;
  int count[4];
  int lrCount;
  int firstBlkIdx;
  SafeInt nBlocksLeft;
  int col1, col2;
  int i, j, n;


  // build blocks for each rotation value
  for (rot = 0; rot < 4; ++rot) {
    pool = pools[rot];
    poolMinBaseIdx = pool->minBaseIdx.Int();
    count[rot] = 0;

    // add blocks until no more words are left

  for (blk = blkList, i = 0; blk; blk = blk->next, ++i) {
    blocks[i] = blk;
  }
  qsort(blocks, nBlocks.Int(), sizeof(TextBlock *), &TextBlock::cmpXYPrimaryRot);

  // column assignment
  for (i = 0; i < nBlocks; ++i) {

  //----- reading order sort

  // sort blocks into yx order (in preparation for reading order sort)
  qsort(blocks, nBlocks.Int(), sizeof(TextBlock *), &TextBlock::cmpYXPrimaryRot);

  // compute space on left and right sides of each block
  for (i = 0; i < nBlocks; ++i) {

  //~ this needs to be adjusted for writing mode (vertical text)
  //~ this also needs to account for right-to-left column ordering
  blkArray = (TextBlock **)gmallocn(nBlocks, sizeof(TextBlock *));
  memcpy(blkArray, blocks, nBlocks.Int() * sizeof(TextBlock *));
  while (flows) {
    flow = flows;
    flows = flows->next;

  xMin0 = xMax0 = yMin0 = yMax0 = 0; // make gcc happy
  xMin1 = xMax1 = yMin1 = yMax1 = 0; // make gcc happy

  for (i = backward ? (nBlocks - 1).Int() : 0;
       backward ? i >= 0 : i < nBlocks;
       i += backward ? -1 : 1) {
    blk = blocks[i];

      }

      if (!line->normalized)
	line->normalized = unicodeNormalizeNFKC(line->text, line->len.Int(),
						&line->normalized_len, 
						&line->normalized_idx);
      // convert the line to uppercase

  TextBlock *blk;
  TextLine *line;
  TextLineFrag *frags;
  int nFrags;
  SafeInt fragsSize;
  TextLineFrag *frag;
  char space[8], eol[16];
  int spaceLen, eolLen;

		}
		++j;
	      }
	      j = (line->len - 1).Int();
	      while (j >= 0) {
		if (0.5 * (line->edge[j] + line->edge[j+1]) < xMax) {
		  idx1 = j;

		}
		++j;
	      }
	      j = (line->len - 1).Int();
	      while (j >= 0) {
		if (0.5 * (line->edge[j] + line->edge[j+1]) < yMax) {
		  idx1 = j;

		}
		++j;
	      }
	      j = (line->len - 1).Int();
	      while (j >= 0) {
		if (0.5 * (line->edge[j] + line->edge[j+1]) > xMin) {
		  idx1 = j;

		}
		++j;
	      }
	      j = (line->len - 1).Int();
	      while (j >= 0) {
		if (0.5 * (line->edge[j] + line->edge[j+1]) > yMin) {
		  idx1 = j;

    }
  }

  edge_begin = len.Int();
  edge_end = 0;
  for (i = 0; i < len; i++) {
    double mid = (edge[i] + edge[i + 1]) /  2;

    }

    if (((selection->x1 > p->xMin && selection->y1 > p->yMin) ||
	(selection->x2 > p->xMin && selection->y2 > p->yMin)) && (begin != NULL))
	&& (begin != NULL))
      end = p->next;
  }


  double start_x, start_y, stop_x, stop_y;
  TextBlock *b;

  begin = nBlocks.Int();
  end = 0;
  start_x = selection->x1;
  start_y = selection->y1;

  TextLine *line;
  TextLineFrag *frags;
  TextWord *word;
  int nFrags;
  SafeInt fragsSize;
  TextLineFrag *frag;
  char space[8], eol[16], eop[8];
  int spaceLen, eolLen, eopLen;

	  frags = (TextLineFrag *)greallocn(frags,
					    fragsSize, sizeof(TextLineFrag));
	}
	frags[nFrags].init(line, 0, line->len.Int());
	frags[nFrags].computeCoords(gTrue);
	++nFrags;
      }

    for (flow = flows; flow; flow = flow->next) {
      for (blk = flow->blocks; blk; blk = blk->next) {
	for (line = blk->lines; line; line = line->next) {
	  n = line->len.Int();
	  if (line->hyphenated && (line->next || blk->next)) {
	    --n;
	  }




  double *edge;			// "near" edge x or y coord of each char
				//   (plus one extra entry for the last char)
  int len;			// length of text and edge arrays
  SafeInt size;			// size of text and edge arrays
  int charPos;                  // character position (within content stream)
  int charLen;                  // number of content stream characters in
                                //   this word

  TextPool();
  ~TextPool();

  TextWord *getPool(int baseIdx) { return pool[(baseIdx - minBaseIdx).Int()]; }
  void setPool(int baseIdx, TextWord *p) { pool[(baseIdx - minBaseIdx).Int()] = p; }

  int getBaseIdx(double base);



private:

  SafeInt minBaseIdx;		// min baseline bucket index
  SafeInt maxBaseIdx;		// max baseline bucket index
  TextWord **pool;		// array of linked lists, one for each
				//   baseline value (multiple of 4 pts)
  TextWord *cursor;		// pointer to last-accessed word

  double *edge;			// "near" edge x or y coord of each char
				//   (plus one extra entry for the last char)
  int *col;			// starting column number of each Unicode char
  SafeInt len;			// number of Unicode chars
  int convertedLen;		// total number of converted characters
  GBool hyphenated;		// set if last char is a hyphen
  TextLine *next;		// next line in block

  void getBBox(double *xMinA, double *yMinA, double *xMaxA, double *yMaxA)
    { *xMinA = xMin; *yMinA = yMin; *xMaxA = xMax; *yMaxA = yMax; }

  int getLineCount() { return nLines.Int(); }

private:


				//   are built)
  TextLine *lines;		// linked list of lines
  TextLine *curLine;		// most recently added line
  SafeInt nLines;			// number of lines
  int charCount;		// number of characters in the block
  int col;			// starting column
  int nColumns;			// number of columns in the block

  TextPool *pools[4];		// a "pool" of TextWords for each rotation
  TextFlow *flows;		// linked list of flows
  TextBlock **blocks;		// array of blocks, in yx order
  SafeInt nBlocks;			// number of blocks
  int primaryRot;		// primary rotation
  GBool primaryLR;		// primary direction (true means L-to-R,
				//   false means R-to-L)

Lines 39-45 UnicodeMap *UnicodeMap::parse(GooString Link Here

(-)poppler-0.12.0/poppler/UnicodeMap.cc (-1 / +1 lines)
39	UnicodeMap *map;	39	UnicodeMap *map;
40	UnicodeMapRange *range;	40	UnicodeMapRange *range;
41	UnicodeMapExt *eMap;	41	UnicodeMapExt *eMap;
42	int size, eMapsSize;	42	SafeInt size, eMapsSize;
43	char buf[256];	43	char buf[256];
44	int line, nBytes, i, x;	44	int line, nBytes, i, x;
45	char tok1, tok2, *tok3;	45	char tok1, tok2, *tok3;

Lines 164-170 int main(int argc, char *argv[]) { Link Here

(-)poppler-0.12.0/utils/pdffonts.cc (-1 / +1 lines)
164	printf("name type emb sub uni object ID\n");	164	printf("name type emb sub uni object ID\n");
165	printf("------------------------------------ ----------------- --- --- --- ---------\n");	165	printf("------------------------------------ ----------------- --- --- --- ---------\n");
166	fonts = NULL;	166	fonts = NULL;
167	fontsLen = fontsSize = 0;	167	fontsSize = fontsLen = 0;
168	for (pg = firstPage; pg <= lastPage; ++pg) {	168	for (pg = firstPage; pg <= lastPage; ++pg) {
169	page = doc->getCatalog()->getPage(pg);	169	page = doc->getCatalog()->getPage(pg);
170	if ((resDict = page->getResourceDict())) {	170	if ((resDict = page->getResourceDict())) {

Lines 377-383 CairoFreeTypeFont *CairoFreeTypeFont::cr Link Here

(-)poppler-0.12.0/poppler/CairoFontEngine.cc (-2 / +2 lines)
377	cairo_font_face_t *font_face;	377	cairo_font_face_t *font_face;
378		378
379	Gushort *codeToGID;	379	Gushort *codeToGID;
380	int codeToGIDLen;	380	SafeInt codeToGIDLen;
381		381
382	dfp = NULL;	382	dfp = NULL;
383	codeToGID = NULL;	383	codeToGID = NULL;
Lines 533-539 CairoFreeTypeFont *CairoFreeTypeFont::cr Link Here
533		533
534	return new CairoFreeTypeFont(ref,	534	return new CairoFreeTypeFont(ref,
535	font_face, face,	535	font_face, face,
536	codeToGID, codeToGIDLen,	536	codeToGID, codeToGIDLen.Int(),
537	substitute);	537	substitute);
538		538
539	err2:	539	err2:




  GBool more;
  Object obj, obj2;
  Guint pos2;
  int first, n, i;
  SafeInt newSize;

  while (1) {
    parser->getObj(&obj);

      goto err1;
    }
    if (first + n > size) {
      for (newSize = size ? SafeInt(2) * SafeInt(size) : 1024;
	   first + n > newSize && newSize > 0;
	   newSize <<= 1) ;
      if (newSize < 0) {

	entries[i].updated = false;
	entries[i].gen = 0;
      }
      size = newSize.Int();
    }
    for (i = first; i < first + n; ++i) {
      if (!parser->getObj(&obj)->isInt()) {


GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
  Guint offset;
  int type, gen, c, i, j;
  SafeInt newSize;

  if (first + n < 0) {
    return gFalse;
  }
  if (first + n > size) {
    for (newSize = size ? SafeInt(2) * SafeInt(size) : 1024;
	 first + n > newSize && newSize > 0;
	 newSize <<= 1) ;
    if (newSize < 0) {

      entries[i].updated = false;
      entries[i].gen = 0;
    }
    size = newSize.Int();
  }
  for (i = first; i < first + n; ++i) {
    if (w[0] == 0) {

  char buf[256];
  Guint pos;
  int num, gen;
  SafeInt newSize;
  SafeInt streamEndsSize;
  char *p;
  int i;
  GBool gotRoot;


  error(-1, "PDF file is damaged - attempting to reconstruct xref table...");
  gotRoot = gFalse;
  streamEndsSize = streamEndsLen = 0;

  str->reset();
  while (1) {

	      } while (*p && isspace(*p));
	      if (!strncmp(p, "obj", 3)) {
		if (num >= size) {
		  newSize = (SafeInt(num) + 1 + 255).Int() & ~255;
		  if (newSize < 0) {
		    error(-1, "Bad object number");
		    return gFalse;

		    entries[i].obj.initNull ();
		    entries[i].updated = false;
		  }
		  size = newSize.Int();
		}
		if (entries[num].type == xrefEntryFree ||
		    gen >= entries[num].gen) {

Return to bug 570183

Lines 116-124 char **FoFiType1C::getEncoding() { Link Here

(-)poppler-0.12.0/fofi/FoFiType1C.cc (-11 / +13 lines)
116	return encoding;	116	return encoding;
117	}	117	}
118		118
119	Gushort FoFiType1C::getCIDToGIDMap(int nCIDs) {	119	Gushort FoFiType1C::getCIDToGIDMap(SafeInt nCIDs) {
120	Gushort *map;	120	Gushort *map;
121	int n, i;	121	SafeInt n;
		122	int i;
122		123
123	// a CID font's top dict has ROS as the first operator	124	// a CID font's top dict has ROS as the first operator
124	if (topDict.firstOp != 0x0c1e) {	125	if (topDict.firstOp != 0x0c1e) {
Lines 136-142 Gushort *FoFiType1C::getCIDToGIDMap(int Link Here
136	}	137	}
137	++n;	138	++n;
138	map = (Gushort *)gmallocn(n, sizeof(Gushort));	139	map = (Gushort *)gmallocn(n, sizeof(Gushort));
139	memset(map, 0, n * sizeof(Gushort));	140	memset(map, 0, n.Int() * sizeof(Gushort));
140	for (i = 0; i < nGlyphs; ++i) {	141	for (i = 0; i < nGlyphs; ++i) {
141	map[charset[i]] = i;	142	map[charset[i]] = i;
142	}	143	}
Lines 452-458 void FoFiType1C::convertToCIDType0(char Link Here
452	int *charStringOffsets;	453	int *charStringOffsets;
453	Type1CIndex subrIdx;	454	Type1CIndex subrIdx;
454	Type1CIndexVal val;	455	Type1CIndexVal val;
455	int nCIDs, gdBytes;	456	SafeInt nCIDs;
		457	int gdBytes;
456	GooString *buf;	458	GooString *buf;
457	char buf2[256];	459	char buf2[256];
458	GBool ok;	460	GBool ok;
Lines 475-481 void FoFiType1C::convertToCIDType0(char Link Here
475		477
476	// build the charstrings	478	// build the charstrings
477	charStrings = new GooString();	479	charStrings = new GooString();
478	charStringOffsets = (int *)gmallocn(nCIDs + 1, sizeof(int));	480	charStringOffsets = (int *)gmallocn(nCIDs + SafeInt(1), sizeof(int));
479	for (i = 0; i < nCIDs; ++i) {	481	for (i = 0; i < nCIDs; ++i) {
480	charStringOffsets[i] = charStrings->getLength();	482	charStringOffsets[i] = charStrings->getLength();
481	if ((gid = cidMap[i]) >= 0) {	483	if ((gid = cidMap[i]) >= 0) {
Lines 491-503 void FoFiType1C::convertToCIDType0(char Link Here
491	}	493	}
492	}	494	}
493	}	495	}
494	charStringOffsets[nCIDs] = charStrings->getLength();	496	charStringOffsets[nCIDs.Int()] = charStrings->getLength();
495		497
496	// compute gdBytes = number of bytes needed for charstring offsets	498	// compute gdBytes = number of bytes needed for charstring offsets
497	// (offset size needs to account for the charstring offset table,	499	// (offset size needs to account for the charstring offset table,
498	// with a worst case of five bytes per entry, plus the charstrings	500	// with a worst case of five bytes per entry, plus the charstrings
499	// themselves)	501	// themselves)
500	i = (nCIDs + 1) * 5 + charStrings->getLength();	502	i = (nCIDs.Int() + 1) * 5 + charStrings->getLength();
501	if (i < 0x100) {	503	if (i < 0x100) {
502	gdBytes = 1;	504	gdBytes = 1;
503	} else if (i < 0x10000) {	505	} else if (i < 0x10000) {
Lines 562-568 void FoFiType1C::convertToCIDType0(char Link Here
562	(*outputFunc)(outputStream, "end def\n", 8);	564	(*outputFunc)(outputStream, "end def\n", 8);
563		565
564	// CIDFont-specific entries	566	// CIDFont-specific entries
565	buf = GooString::format("/CIDCount {0:d} def\n", nCIDs);	567	buf = GooString::format("/CIDCount {0:d} def\n", nCIDs.Int());
566	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	568	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
567	delete buf;	569	delete buf;
568	(*outputFunc)(outputStream, "/FDBytes 1 def\n", 15);	570	(*outputFunc)(outputStream, "/FDBytes 1 def\n", 15);
Lines 580-586 void FoFiType1C::convertToCIDType0(char Link Here
580	}	582	}
581		583
582	// FDArray entry	584	// FDArray entry
583	buf = GooString::format("/FDArray {0:d} array\n", nFDs);	585	buf = GooString::format("/FDArray {0:d} array\n", nFDs.Int());
584	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	586	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
585	delete buf;	587	delete buf;
586	for (i = 0; i < nFDs; ++i) {	588	for (i = 0; i < nFDs; ++i) {
Lines 723-729 void FoFiType1C::convertToCIDType0(char Link Here
723	(*outputFunc)(outputStream, "def\n", 4);	725	(*outputFunc)(outputStream, "def\n", 4);
724		726
725	// start the binary section	727	// start the binary section
726	offset = (nCIDs + 1) * (1 + gdBytes);	728	offset = (nCIDs.Int() + 1) * (1 + gdBytes);
727	buf = GooString::format("(Hex) {0:d} StartData\n",	729	buf = GooString::format("(Hex) {0:d} StartData\n",
728	offset + charStrings->getLength());	730	offset + charStrings->getLength());
729	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	731	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
Lines 776-782 void FoFiType1C::convertToType0(char *ps Link Here
776	int *cidMap;	778	int *cidMap;
777	Type1CIndex subrIdx;	779	Type1CIndex subrIdx;
778	Type1CIndexVal val;	780	Type1CIndexVal val;
779	int nCIDs;	781	SafeInt nCIDs;
780	GooString *buf;	782	GooString *buf;
781	Type1CEexecBuf eb;	783	Type1CEexecBuf eb;
782	GBool ok;	784	GBool ok;

Lines 2005-2011 SplashError Splash::fillImageMask(Splash Link Here

(-)poppler-0.12.0/splash/Splash.cc (-9 / +9 lines)
2005	if (yp < 0 \|\| yp > INT_MAX - 1) {	2005	if (yp < 0 \|\| yp > INT_MAX - 1) {
2006	return splashErrBadArg;	2006	return splashErrBadArg;
2007	}	2007	}
2008	pixBuf = (SplashColorPtr)gmallocn((yp + 1), w);	2008	pixBuf = (SplashColorPtr)gmallocn((SafeInt(yp) + SafeInt(1)), SafeInt(w));
2009		2009
2010	// initialize the pixel pipe	2010	// initialize the pixel pipe
2011	pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,	2011	pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
Lines 2310-2316 SplashError Splash::drawImage(SplashImag Link Here
2310	}	2310	}
2311	colorBuf = (SplashColorPtr)gmallocn3((yp + 1), w, nComps);	2311	colorBuf = (SplashColorPtr)gmallocn3((yp + 1), w, nComps);
2312	if (srcAlpha) {	2312	if (srcAlpha) {
2313	alphaBuf = (Guchar *)gmallocn((yp + 1), w);	2313	alphaBuf = (Guchar )gmalloc(((SafeInt(yp) + SafeInt(1)) SafeInt(w)).Int());
2314	} else {	2314	} else {
2315	alphaBuf = NULL;	2315	alphaBuf = NULL;
2316	}	2316	}
Lines 3327-3333 SplashPath *Splash::makeStrokePath(Splas Link Here
3327	// draw the start cap	3327	// draw the start cap
3328	pathOut->moveTo(pathIn->pts[i].x - wdy, pathIn->pts[i].y + wdx);	3328	pathOut->moveTo(pathIn->pts[i].x - wdy, pathIn->pts[i].y + wdx);
3329	if (i == subpathStart) {	3329	if (i == subpathStart) {
3330	firstPt = pathOut->length - 1;	3330	firstPt = pathOut->length.Int() - 1;
3331	}	3331	}
3332	if (first && !closed) {	3332	if (first && !closed) {
3333	switch (state->lineCap) {	3333	switch (state->lineCap) {
Lines 3362-3368 SplashPath *Splash::makeStrokePath(Splas Link Here
3362	}	3362	}
3363		3363
3364	// draw the left side of the segment rectangle	3364	// draw the left side of the segment rectangle
3365	left2 = pathOut->length - 1;	3365	left2 = pathOut->length.Int() - 1;
3366	pathOut->lineTo(pathIn->pts[i+1].x + wdy, pathIn->pts[i+1].y - wdx);	3366	pathOut->lineTo(pathIn->pts[i+1].x + wdy, pathIn->pts[i+1].y - wdx);
3367		3367
3368	// draw the end cap	3368	// draw the end cap
Lines 3399-3409 SplashPath *Splash::makeStrokePath(Splas Link Here
3399	}	3399	}
3400		3400
3401	// draw the right side of the segment rectangle	3401	// draw the right side of the segment rectangle
3402	right2 = pathOut->length - 1;	3402	right2 = pathOut->length.Int() - 1;
3403	pathOut->close();	3403	pathOut->close();
3404		3404
3405	// draw the join	3405	// draw the join
3406	join2 = pathOut->length;	3406	join2 = pathOut->length.Int();
3407	if (!last \|\| closed) {	3407	if (!last \|\| closed) {
3408	crossprod = dx * dyNext - dy * dxNext;	3408	crossprod = dx * dyNext - dy * dxNext;
3409	dotprod = -(dx * dxNext + dy * dyNext);	3409	dotprod = -(dx * dxNext + dy * dyNext);
Lines 3517-3526 SplashPath *Splash::makeStrokePath(Splas Link Here
3517	if (i >= subpathStart + 2) {	3517	if (i >= subpathStart + 2) {
3518	pathOut->addStrokeAdjustHint(left1, right1, left0 + 1, right0);	3518	pathOut->addStrokeAdjustHint(left1, right1, left0 + 1, right0);
3519	pathOut->addStrokeAdjustHint(left1, right1,	3519	pathOut->addStrokeAdjustHint(left1, right1,
3520	join0, pathOut->length - 1);	3520	join0, pathOut->length.Int() - 1);
3521	} else {	3521	} else {
3522	pathOut->addStrokeAdjustHint(left1, right1,	3522	pathOut->addStrokeAdjustHint(left1, right1,
3523	firstPt, pathOut->length - 1);	3523	firstPt, pathOut->length.Int() - 1);
3524	}	3524	}
3525	if (closed) {	3525	if (closed) {
3526	pathOut->addStrokeAdjustHint(left1, right1, firstPt, leftFirst);	3526	pathOut->addStrokeAdjustHint(left1, right1, firstPt, leftFirst);
Lines 3529-3535 SplashPath *Splash::makeStrokePath(Splas Link Here
3529	pathOut->addStrokeAdjustHint(leftFirst, rightFirst,	3529	pathOut->addStrokeAdjustHint(leftFirst, rightFirst,
3530	left1 + 1, right1);	3530	left1 + 1, right1);
3531	pathOut->addStrokeAdjustHint(leftFirst, rightFirst,	3531	pathOut->addStrokeAdjustHint(leftFirst, rightFirst,
3532	join1, pathOut->length - 1);	3532	join1, pathOut->length.Int() - 1);
3533	}	3533	}
3534	}	3534	}
3535	}	3535	}

Lines 180-186 GBool SplashFTFont::makeGlyph(int c, int Link Here

(-)poppler-0.12.0/splash/SplashFTFont.cc (-4 / +4 lines)
180	FT_Vector offset;	180	FT_Vector offset;
181	FT_GlyphSlot slot;	181	FT_GlyphSlot slot;
182	FT_UInt gid;	182	FT_UInt gid;
183	int rowSize;	183	SafeInt rowSize;
184	Guchar p, q;	184	Guchar p, q;
185	int i;	185	int i;
186		186
Lines 235-248 GBool SplashFTFont::makeGlyph(int c, int Link Here
235	if (aa) {	235	if (aa) {
236	rowSize = bitmap->w;	236	rowSize = bitmap->w;
237	} else {	237	} else {
238	rowSize = (bitmap->w + 7) >> 3;	238	rowSize = (SafeInt(bitmap->w) + SafeInt(7)) >> 3;
239	}	239	}
240	bitmap->data = (Guchar *)gmallocn_checkoverflow(rowSize, bitmap->h);	240	bitmap->data = (Guchar *)gmallocn_checkoverflow(rowSize, bitmap->h);
241	bitmap->freeData = gTrue;	241	bitmap->freeData = gTrue;
242	for (i = 0, p = bitmap->data, q = slot->bitmap.buffer;	242	for (i = 0, p = bitmap->data, q = slot->bitmap.buffer;
243	i < bitmap->h;	243	i < bitmap->h;
244	++i, p += rowSize, q += slot->bitmap.pitch) {	244	++i, p += rowSize.Int(), q += slot->bitmap.pitch) {
245	memcpy(p, q, rowSize);	245	memcpy(p, q, rowSize.Int());
246	}	246	}
247		247
248	return gTrue;	248	return gTrue;

Lines 152-158 SplashXPath::SplashXPath(SplashPath *pat Link Here

(-)poppler-0.12.0/splash/SplashXPath.cc (-25 / +25 lines)
152	xsp = x0;	152	xsp = x0;
153	ysp = y0;	153	ysp = y0;
154	curSubpath = i;	154	curSubpath = i;
155	curSubpathX = length;	155	curSubpathX = length.Int();
156	++i;	156	++i;
157		157
158	} else {	158	} else {
Lines 241-247 SplashXPath::SplashXPath(SplashXPath *xP Link Here
241	length = xPath->length;	241	length = xPath->length;
242	size = xPath->size;	242	size = xPath->size;
243	segs = (SplashXPathSeg *)gmallocn(size, sizeof(SplashXPathSeg));	243	segs = (SplashXPathSeg *)gmallocn(size, sizeof(SplashXPathSeg));
244	memcpy(segs, xPath->segs, length * sizeof(SplashXPathSeg));	244	memcpy(segs, xPath->segs, length.Int() * sizeof(SplashXPathSeg));
245	}	245	}
246		246
247	SplashXPath::~SplashXPath() {	247	SplashXPath::~SplashXPath() {
Lines 349-399 void SplashXPath::addSegment(SplashCoord Link Here
349	SplashCoord x1, SplashCoord y1,	349	SplashCoord x1, SplashCoord y1,
350	GBool first, GBool last, GBool end0, GBool end1) {	350	GBool first, GBool last, GBool end0, GBool end1) {
351	grow(1);	351	grow(1);
352	segs[length].x0 = x0;	352	segs[length.Int()].x0 = x0;
353	segs[length].y0 = y0;	353	segs[length.Int()].y0 = y0;
354	segs[length].x1 = x1;	354	segs[length.Int()].x1 = x1;
355	segs[length].y1 = y1;	355	segs[length.Int()].y1 = y1;
356	segs[length].flags = 0;	356	segs[length.Int()].flags = 0;
357	if (first) {	357	if (first) {
358	segs[length].flags \|= splashXPathFirst;	358	segs[length.Int()].flags \|= splashXPathFirst;
359	}	359	}
360	if (last) {	360	if (last) {
361	segs[length].flags \|= splashXPathLast;	361	segs[length.Int()].flags \|= splashXPathLast;
362	}	362	}
363	if (end0) {	363	if (end0) {
364	segs[length].flags \|= splashXPathEnd0;	364	segs[length.Int()].flags \|= splashXPathEnd0;
365	}	365	}
366	if (end1) {	366	if (end1) {
367	segs[length].flags \|= splashXPathEnd1;	367	segs[length.Int()].flags \|= splashXPathEnd1;
368	}	368	}
369	if (y1 == y0) {	369	if (y1 == y0) {
370	segs[length].dxdy = segs[length].dydx = 0;	370	segs[length.Int()].dxdy = segs[length.Int()].dydx = 0;
371	segs[length].flags \|= splashXPathHoriz;	371	segs[length.Int()].flags \|= splashXPathHoriz;
372	if (x1 == x0) {	372	if (x1 == x0) {
373	segs[length].flags \|= splashXPathVert;	373	segs[length.Int()].flags \|= splashXPathVert;
374	}	374	}
375	} else if (x1 == x0) {	375	} else if (x1 == x0) {
376	segs[length].dxdy = segs[length].dydx = 0;	376	segs[length.Int()].dxdy = segs[length.Int()].dydx = 0;
377	segs[length].flags \|= splashXPathVert;	377	segs[length.Int()].flags \|= splashXPathVert;
378	} else {	378	} else {
379	#if USE_FIXEDPOINT	379	#if USE_FIXEDPOINT
380	if (FixedPoint::divCheck(x1 - x0, y1 - y0, &segs[length].dxdy)) {	380	if (FixedPoint::divCheck(x1 - x0, y1 - y0, &segs[length.Int()].dxdy)) {
381	segs[length].dydx = (SplashCoord)1 / segs[length].dxdy;	381	segs[length.Int()].dydx = (SplashCoord)1 / segs[length.Int()].dxdy;
382	} else {	382	} else {
383	segs[length].dxdy = segs[length].dydx = 0;	383	segs[length.Int()].dxdy = segs[length.Int()].dydx = 0;
384	if (splashAbs(x1 - x0) > splashAbs(y1 - y0)) {	384	if (splashAbs(x1 - x0) > splashAbs(y1 - y0)) {
385	segs[length].flags \|= splashXPathHoriz;	385	segs[length.Int()].flags \|= splashXPathHoriz;
386	} else {	386	} else {
387	segs[length].flags \|= splashXPathVert;	387	segs[length.Int()].flags \|= splashXPathVert;
388	}	388	}
389	}	389	}
390	#else	390	#else
391	segs[length].dxdy = (x1 - x0) / (y1 - y0);	391	segs[length.Int()].dxdy = (x1 - x0) / (y1 - y0);
392	segs[length].dydx = (SplashCoord)1 / segs[length].dxdy;	392	segs[length.Int()].dydx = (SplashCoord)1 / segs[length.Int()].dxdy;
393	#endif	393	#endif
394	}	394	}
395	if (y0 > y1) {	395	if (y0 > y1) {
396	segs[length].flags \|= splashXPathFlip;	396	segs[length.Int()].flags \|= splashXPathFlip;
397	}	397	}
398	++length;	398	++length;
399	}	399	}
Lines 439-443 void SplashXPath::aaScale() { Link Here
439	}	439	}
440		440
441	void SplashXPath::sort() {	441	void SplashXPath::sort() {
442	qsort(segs, length, sizeof(SplashXPathSeg), &cmpXPathSegs);	442	qsort(segs, length.Int(), sizeof(SplashXPathSeg), &cmpXPathSegs);
443	}	443	}

Lines 233-239 SampledFunction::SampledFunction(Object Link Here

(-)poppler-0.12.0/poppler/Function.cc (-12 / +12 lines)
233	}	233	}
234		234
235	//----- buffer	235	//----- buffer
236	sBuf = (double *)gmallocn(1 << m, sizeof(double));	236	sBuf = (double *)gmallocn((SafeInt(1) << m).Int(), sizeof(double));
237		237
238	//----- get the stream	238	//----- get the stream
239	if (!funcObj->isStream()) {	239	if (!funcObj->isStream()) {
Lines 385-392 SampledFunction::~SampledFunction() { Link Here
385	SampledFunction::SampledFunction(SampledFunction *func) {	385	SampledFunction::SampledFunction(SampledFunction *func) {
386	memcpy(this, func, sizeof(SampledFunction));	386	memcpy(this, func, sizeof(SampledFunction));
387	samples = (double *)gmallocn(nSamples, sizeof(double));	387	samples = (double *)gmallocn(nSamples, sizeof(double));
388	memcpy(samples, func->samples, nSamples * sizeof(double));	388	memcpy(samples, func->samples, (nSamples * sizeof(double)).Int());
389	sBuf = (double *)gmallocn(1 << m, sizeof(double));	389	sBuf = (double *)gmallocn((SafeInt(1) << m).Int(), sizeof(double));
390	}	390	}
391		391
392	void SampledFunction::transform(double in, double out) {	392	void SampledFunction::transform(double in, double out) {
Lines 591-598 StitchingFunction::StitchingFunction(Obj Link Here
591	}	591	}
592	k = obj1.arrayGetLength();	592	k = obj1.arrayGetLength();
593	funcs = (Function *)gmallocn(k, sizeof(Function ));	593	funcs = (Function *)gmallocn(k, sizeof(Function ));
594	bounds = (double *)gmallocn(k + 1, sizeof(double));	594	bounds = (double *)gmallocn(k + SafeInt(1), sizeof(double));
595	encode = (double )gmallocn(2 k, sizeof(double));	595	encode = (double )gmallocn(SafeInt(2) k, sizeof(double));
596	scale = (double *)gmallocn(k, sizeof(double));	596	scale = (double *)gmallocn(k, sizeof(double));
597	for (i = 0; i < k; ++i) {	597	for (i = 0; i < k; ++i) {
598	funcs[i] = NULL;	598	funcs[i] = NULL;
Lines 625-631 StitchingFunction::StitchingFunction(Obj Link Here
625	bounds[i] = obj2.getNum();	625	bounds[i] = obj2.getNum();
626	obj2.free();	626	obj2.free();
627	}	627	}
628	bounds[k] = domain[0][1];	628	bounds[k.Int()] = domain[0][1];
629	obj1.free();	629	obj1.free();
630		630
631	//----- Encode	631	//----- Encode
Lines 674-685 StitchingFunction::StitchingFunction(Sti Link Here
674	for (i = 0; i < k; ++i) {	674	for (i = 0; i < k; ++i) {
675	funcs[i] = func->funcs[i]->copy();	675	funcs[i] = func->funcs[i]->copy();
676	}	676	}
677	bounds = (double *)gmallocn(k + 1, sizeof(double));	677	bounds = (double *)gmallocn(k + SafeInt(1), sizeof(double));
678	memcpy(bounds, func->bounds, (k + 1) * sizeof(double));	678	memcpy(bounds, func->bounds, ((k + 1) * sizeof(double)).Int());
679	encode = (double )gmallocn(2 k, sizeof(double));	679	encode = (double )gmallocn(SafeInt(2) k, sizeof(double));
680	memcpy(encode, func->encode, 2 * k * sizeof(double));	680	memcpy(encode, func->encode, (2 * k * sizeof(double)).Int());
681	scale = (double *)gmallocn(k, sizeof(double));	681	scale = (double *)gmallocn(k, sizeof(double));
682	memcpy(scale, func->scale, k * sizeof(double));	682	memcpy(scale, func->scale, (k * sizeof(double)).Int());
683	ok = gTrue;	683	ok = gTrue;
684	}	684	}
685		685
Lines 1155-1161 PostScriptFunction::PostScriptFunction(O Link Here
1155	PostScriptFunction::PostScriptFunction(PostScriptFunction *func) {	1155	PostScriptFunction::PostScriptFunction(PostScriptFunction *func) {
1156	memcpy(this, func, sizeof(PostScriptFunction));	1156	memcpy(this, func, sizeof(PostScriptFunction));
1157	code = (PSObject *)gmallocn(codeSize, sizeof(PSObject));	1157	code = (PSObject *)gmallocn(codeSize, sizeof(PSObject));
1158	memcpy(code, func->code, codeSize * sizeof(PSObject));	1158	memcpy(code, func->code, (codeSize * sizeof(PSObject)).Int());
1159	codeString = func->codeString->copy();	1159	codeString = func->codeString->copy();
1160	stack = new PSStack();	1160	stack = new PSStack();
1161	memcpy(stack, func->stack, sizeof(PSStack));	1161	memcpy(stack, func->stack, sizeof(PSStack));

Lines 189-202 void grealloc_checkoverflow(void p, si Link Here

(-)poppler-0.12.0/goo/gmem.cc (-10 / +348 lines)
189	return grealloc(p, size, true);	189	return grealloc(p, size, true);
190	}	190	}
191		191
192	inline static void *gmallocn(int nObjs, int objSize, bool checkoverflow) GMEM_EXCEP {	192	SafeInt::SafeInt(const long long int cA)
193	int n;	193	{
		194	if (cA < -INT_MAX \|\| INT_MAX < cA)
		195	integer_overflow("SafeInt::SafeInt(long long): ");
		196	c = cA;
		197	}
		198
		199	SafeInt::SafeInt()
		200	{ }
		201
		202	SafeInt::SafeInt(const SafeInt& copy): c(copy.c)
		203	{ }
		204
		205	SafeInt SafeInt::create(const long long int cA)
		206	{
		207	return SafeInt(cA);
		208	}
		209
		210	int SafeInt::Int(void) const
		211	{
		212	return c;
		213	}
		214
		215	void SafeInt::integer_overflow(const char * prefix)
		216	{
		217	fprintf(stderr, "error: %sinteger overflow", prefix);
		218	exit (1);
		219	}
		220
		221	void SafeInt::division_by_zero(const char * prefix)
		222	{
		223	fprintf(stderr, "error: %sdivide by zero", prefix);
		224	exit(1);
		225	}
		226
		227	void SafeInt::shift_is_negative(const char * prefix)
		228	{
		229	fprintf(stderr, "warning: %sbitwise shift amount is negative", prefix);
		230	}
		231
		232	SafeInt& SafeInt::operator=(const int& cA)
		233	{
		234	*this = SafeInt(cA);
		235	return *this;
		236	}
		237
		238	bool SafeInt::operator==(const SafeInt& right) const
		239	{
		240	return c == right.c;
		241	}
		242
		243	bool SafeInt::operator!=(const SafeInt& right) const
		244	{
		245	return c != right.c;
		246	}
		247
		248	bool SafeInt::operator<(const SafeInt& right) const
		249	{
		250	return c < right.c;
		251	}
		252
		253	bool SafeInt::operator<=(const SafeInt& right) const
		254	{
		255	return c <= right.c;
		256	}
		257
258	bool SafeInt::operator>(const SafeInt& right) const
259	{
260	return c > right.c;
261	}
262
263	bool SafeInt::operator>=(const SafeInt& right) const
264	{
265	return c >= right.c;
266	}
267
268	bool SafeInt::operator==(const int& right) const
269	{
270	return c == right;
271	}
272
273	bool SafeInt::operator!=(const int& right) const
274	{
275	return c != right;
276	}
277
278	bool SafeInt::operator<(const int& right) const
279	{
280	return c < right;
281	}
282
283	bool SafeInt::operator<=(const int& right) const
284	{
285	return c <= right;
286	}
287
288	bool SafeInt::operator>(const int& right) const
289	{
290	return c > right;
291	}
292
293	bool SafeInt::operator>=(const int& right) const
294	{
295	return c >= right;
296	}
297
298	bool operator==(const int& left, const SafeInt& right)
299	{
300	return left == right.c;
301	}
302
303	bool operator!=(const int& left, const SafeInt& right)
304	{
305	return left != right.c;
306	}
307
308	bool operator<(const int& left, const SafeInt& right)
309	{
310	return left < right.c;
311	}
312
313	bool operator<=(const int& left, const SafeInt& right)
314	{
315	return left <= right.c;
316	}
317
318	bool operator>(const int& left, const SafeInt& right)
319	{
320	return left > right.c;
321	}
322
323	bool operator>=(const int& left, const SafeInt& right)
324	{
325	return left >= right.c;
326	}
327
328	SafeInt SafeInt::operator+() const
329	{
330	return SafeInt(*this);
331	}
332
333	SafeInt SafeInt::operator+(const SafeInt& right) const
334	{
335	if (c*right.c > 0 &&
336	((c > 0 && c > INT_MAX - right.c) \|\|
337	(c < 0 && c < -INT_MAX - right.c)))
338	integer_overflow("SafeInt::operator+(): ");
339	return SafeInt(c + right.c);
340	}
341
342	SafeInt SafeInt::operator-() const
343	{
344	return SafeInt(-c);
345	}
346
347	SafeInt SafeInt::operator-(const SafeInt& right) const
348	{
349	return *this + (-right);
350	}
351
352	SafeInt SafeInt::operator*(const SafeInt& right) const
353	{
354	if (right.c != 0 && c*right.c/right.c != c)
355	integer_overflow("SafeInt::operator*(): ");
356	return SafeInt(c * right.c);
357	}
358
359	SafeInt SafeInt::operator/(const SafeInt& right) const
360	{
361	return SafeInt(c / right.c);
362	}
194		363
195	if (nObjs == 0) {	364	SafeInt SafeInt::operator%(const SafeInt& right) const
		365	{
		366	return SafeInt(c % right.c);
		367	}
		368
		369	SafeInt SafeInt::operator/(const int& right) const
		370	{
		371	if (right == 0)
		372	division_by_zero("SafeInt::operator/(): ");
		373	return SafeInt(c / right);
		374	}
		375
		376	SafeInt SafeInt::operator%(const int& right) const
		377	{
		378	return SafeInt(c % right);
		379	}
		380
		381	SafeInt& SafeInt::operator+=(const SafeInt& right)
		382	{
		383	this = this + right;
		384	return *this;
		385	}
		386
		387	SafeInt& SafeInt::operator-=(const SafeInt& right)
		388	{
		389	this = this - right;
		390	return *this;
		391	}
		392
		393	SafeInt& SafeInt::operator*=(const SafeInt& right)
		394	{
		395	this = this * right;
		396	return *this;
		397	}
		398
		399	SafeInt& SafeInt::operator/=(const SafeInt& right)
		400	{
		401	this = this / right;
		402	return *this;
		403	}
		404
		405	SafeInt& SafeInt::operator%=(const SafeInt& right)
		406	{
		407	this = this % right;
		408	return *this;
		409	}
		410
		411	SafeInt& SafeInt::operator/=(const int& right)
		412	{
		413	this = this / right;
		414	return *this;
		415	}
		416
		417	SafeInt& SafeInt::operator%=(const int& right)
		418	{
		419	this = this % right;
		420	return *this;
		421	}
		422
		423	SafeInt& SafeInt::operator++()
		424	{
		425	*this += one;
		426	return *this;
		427	}
		428
429	SafeInt SafeInt::operator++(int)
430	{
431	SafeInt res(*this);
432	*this += one;
433	return res;
434	}
435
436	SafeInt& SafeInt::operator--()
437	{
438	*this -= one;
439	return *this;
440	}
441
442	SafeInt SafeInt::operator--(int)
443	{
444	SafeInt res(*this);
445	*this -= one;
446	return res;
447	}
448
449	SafeInt operator+(const int& left, const SafeInt& right)
450	{
451	return SafeInt(left) + right;
452	}
453
454	SafeInt operator-(const int& left, const SafeInt& right)
455	{
456	return SafeInt(left) - right;
457	}
458
459	SafeInt operator*(const int& left, const SafeInt& right)
460	{
461	return SafeInt(left) * right;
462	}
463
464	SafeInt operator/(const int& left, const SafeInt& right)
465	{
466	return SafeInt(left) / right;
467	}
468
469	SafeInt operator%(const int& left, const SafeInt& right)
470	{
471	return SafeInt(left) % right;
472	}
473
474	SafeInt SafeInt::operator<<(const int offset)
475	{
476	if (offset < 0)
477	{
478	shift_is_negative("SafeInt::operator<<(): ");
479	return *this >> -offset;
480	}
481
482	if ((c & (-1 << (sizeof(c)*8 - offset))) != 0)
483	integer_overflow("SafeInt::operator<<(): ");
484	return SafeInt(c << offset);
485	}
486
487	SafeInt SafeInt::operator>>(const int offset)
488	{
489	if (offset < 0)
490	{
491	shift_is_negative("SafeInt::operator>>(): ");
492	return *this << -offset;
493	}
494
495	return SafeInt(c >> offset);
496	}
497
498	SafeInt& SafeInt::operator<<=(const int offset)
499	{
500	this = this << offset;
501	return *this;
502	}
503
504	SafeInt& SafeInt::operator>>=(const int offset)
505	{
506	this = this >> offset;
507	return *this;
508	}
509
510	const SafeInt SafeInt::zero = SafeInt(0);
511	const SafeInt SafeInt::one = SafeInt(1);
512
513	inline static void *gmallocn(SafeInt nObjs, SafeInt objSize, bool checkoverflow) GMEM_EXCEP {
514	SafeInt n;
515
516	if (nObjs == SafeInt::create(0)) {
196	return NULL;	517	return NULL;
197	}	518	}
198	n = nObjs * objSize;	519	n = nObjs * objSize;
199	if (objSize <= 0 \|\| nObjs < 0 \|\| nObjs >= INT_MAX / objSize) {	520	if (objSize <= SafeInt::create(0) \|\| nObjs < SafeInt::create(0)) {
200	#if USE_EXCEPTIONS	521	#if USE_EXCEPTIONS
201	throw GMemException();	522	throw GMemException();
202	#else	523	#else
Lines 205-217 inline static void *gmallocn(int nObjs, Link Here
205	else exit(1);	526	else exit(1);
206	#endif	527	#endif
207	}	528	}
208	return gmalloc(n, checkoverflow);	529	return gmalloc(n.Int(), checkoverflow);
		530	}
		531
		532	void *gmallocn(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
		533	return gmallocn(nObjs, objSize, false);
209	}	534	}
210		535
211	void *gmallocn(int nObjs, int objSize) GMEM_EXCEP {	536	void *gmallocn(int nObjs, int objSize) GMEM_EXCEP {
212	return gmallocn(nObjs, objSize, false);	537	return gmallocn(nObjs, objSize, false);
213	}	538	}
214		539
		540	void *gmallocn_checkoverflow(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
		541	return gmallocn(nObjs, objSize, true);
		542	}
		543
215	void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP {	544	void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP {
216	return gmallocn(nObjs, objSize, true);	545	return gmallocn(nObjs, objSize, true);
217	}	546	}
Lines 238-254 void *gmallocn3_checkoverflow(int a, int Link Here
238	return gmallocn3(a, b, c, true);	567	return gmallocn3(a, b, c, true);
239	}	568	}
240		569
241	inline static void greallocn(void p, int nObjs, int objSize, bool checkoverflow) GMEM_EXCEP {	570	inline static void greallocn(void p, SafeInt nObjs, SafeInt objSize, bool checkoverflow) GMEM_EXCEP {
242	int n;	571	SafeInt n;
243		572
244	if (nObjs == 0) {	573	if (nObjs == SafeInt::create(0)) {
245	if (p) {	574	if (p) {
246	gfree(p);	575	gfree(p);
247	}	576	}
248	return NULL;	577	return NULL;
249	}	578	}
250	n = nObjs * objSize;	579	n = nObjs * objSize;
251	if (objSize <= 0 \|\| nObjs < 0 \|\| nObjs >= INT_MAX / objSize) {	580	if (objSize <= SafeInt::create(0) \|\| nObjs < SafeInt::create(0)) {
252	#if USE_EXCEPTIONS	581	#if USE_EXCEPTIONS
253	throw GMemException();	582	throw GMemException();
254	#else	583	#else
Lines 257-269 inline static void greallocn(void p, i Link Here
257	else exit(1);	586	else exit(1);
258	#endif	587	#endif
259	}	588	}
260	return grealloc(p, n, checkoverflow);	589	return grealloc(p, n.Int(), checkoverflow);
		590	}
		591
		592	void greallocn(void p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
		593	return greallocn(p, nObjs, objSize, false);
261	}	594	}
262		595
263	void greallocn(void p, int nObjs, int objSize) GMEM_EXCEP {	596	void greallocn(void p, int nObjs, int objSize) GMEM_EXCEP {
264	return greallocn(p, nObjs, objSize, false);	597	return greallocn(p, nObjs, objSize, false);
265	}	598	}
266		599
		600
		601	void greallocn_checkoverflow(void p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP {
		602	return greallocn(p, nObjs, objSize, true);
		603	}
		604
267	void greallocn_checkoverflow(void p, int nObjs, int objSize) GMEM_EXCEP {	605	void greallocn_checkoverflow(void p, int nObjs, int objSize) GMEM_EXCEP {
268	return greallocn(p, nObjs, objSize, true);	606	return greallocn(p, nObjs, objSize, true);
269	}	607	}

Lines 45-50 public: Link Here

(-)poppler-0.12.0/goo/gmem.h (+102 lines)
45	#endif // USE_EXCEPTIONS	45	#endif // USE_EXCEPTIONS
46		46
47	#ifdef __cplusplus	47	#ifdef __cplusplus
		48	class SafeInt
		49	{
		50	int c;
		51
		52	public:
		53	SafeInt();
		54	SafeInt(const SafeInt& copy);
		55	SafeInt(const long long int cA);
		56	static SafeInt create(const long long int cA);
		57	int Int(void) const;
		58
		59	const static SafeInt zero;
		60	const static SafeInt one;
		61
		62	static void integer_overflow(const char * prefix = NULL);
		63	static void division_by_zero(const char * prefix = NULL);
		64	static void shift_is_negative(const char * prefix = NULL);
		65
		66	SafeInt& operator=(const int& cA);
		67
		68	bool operator==(const SafeInt& right) const;
		69	bool operator!=(const SafeInt& right) const;
		70	bool operator<(const SafeInt& right) const;
		71	bool operator<=(const SafeInt& right) const;
		72	bool operator >(const SafeInt& right) const;
		73	bool operator >=(const SafeInt& right) const;
		74
		75	bool operator==(const int& right) const;
		76	bool operator!=(const int& right) const;
		77	bool operator<(const int& right) const;
		78	bool operator<=(const int& right) const;
		79	bool operator >(const int& right) const;
		80	bool operator >=(const int& right) const;
		81
		82	friend bool operator ==(const int &left, const SafeInt& right);
		83	friend bool operator !=(const int &left, const SafeInt& right);
		84	friend bool operator <(const int &left, const SafeInt& right);
		85	friend bool operator <=(const int &left, const SafeInt& right);
		86	friend bool operator >(const int &left, const SafeInt& right);
		87	friend bool operator >=(const int &left, const SafeInt& right);
		88
		89	SafeInt operator+() const;
		90	SafeInt operator+(const SafeInt& right) const;
		91	SafeInt operator-() const;
		92	SafeInt operator-(const SafeInt& right) const;
		93	SafeInt operator*(const SafeInt& right) const;
		94	SafeInt operator/(const SafeInt& right) const;
		95	SafeInt operator%(const SafeInt& right) const;
		96
		97	SafeInt operator/(const int& right) const;
		98	SafeInt operator%(const int& right) const;
		99
		100	SafeInt& operator+=(const SafeInt& right);
		101	SafeInt& operator-=(const SafeInt& right);
		102	SafeInt& operator*=(const SafeInt& right);
		103	SafeInt& operator/=(const SafeInt& right);
		104	SafeInt& operator%=(const SafeInt& right);
		105
		106	SafeInt& operator/=(const int& right);
		107	SafeInt& operator%=(const int& right);
		108
		109	friend SafeInt operator+(const int& left, const SafeInt& right);
		110	friend SafeInt operator-(const int& left, const SafeInt& right);
		111	friend SafeInt operator*(const int& left, const SafeInt& right);
112	friend SafeInt operator/(const int& left, const SafeInt& right);
113	friend SafeInt operator%(const int& left, const SafeInt& right);
114
115	SafeInt& operator++();
116	SafeInt operator++(int);
117	SafeInt& operator--();
118	SafeInt operator--(int);
119
120	SafeInt operator<<(const int offset);
121	SafeInt operator>>(const int offset);
122
123	SafeInt& operator<<=(const int offset);
124	SafeInt& operator>>=(const int offset);
125	};
126
127	bool operator==(const int& left, const SafeInt& right);
128	bool operator!=(const int& left, const SafeInt& right);
129	bool operator<(const int& left, const SafeInt& right);
130	bool operator<=(const int& left, const SafeInt& right);
131	bool operator>(const int& left, const SafeInt& right);
132	bool operator>=(const int& left, const SafeInt& right);
133
134	SafeInt operator+(const int& left, const SafeInt& right);
135	SafeInt operator-(const int& left, const SafeInt& right);
136	SafeInt operator*(const int& left, const SafeInt& right);
137	SafeInt operator/(const int& left, const SafeInt& right);
138	SafeInt operator%(const int& left, const SafeInt& right);
139	#endif
140
141	#ifdef __cplusplus
48	extern "C" {	142	extern "C" {
49	#endif	143	#endif
50		144
Lines 105-108 extern char gstrndup(const char s, siz Link Here
105	}	199	}
106	#endif	200	#endif
107		201
		202
		203	#ifdef __cplusplus
		204	extern void *gmallocn(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
		205	extern void *gmallocn_checkoverflow(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
		206	extern void greallocn(void p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
		207	extern void greallocn_checkoverflow(void p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP;
		208	#endif
		209
108	#endif	210	#endif

Lines 444-450 int FoFiTrueType::mapNameToGID(char *nam Link Here

(-)poppler-0.12.0/fofi/FoFiTrueType.cc (-45 / +46 lines)
444	return nameToGID->lookupInt(name);	444	return nameToGID->lookupInt(name);
445	}	445	}
446		446
447	Gushort FoFiTrueType::getCIDToGIDMap(int nCIDs) {	447	Gushort FoFiTrueType::getCIDToGIDMap(SafeInt nCIDs) {
448	FoFiType1C *ff;	448	FoFiType1C *ff;
449	Gushort *map;	449	Gushort *map;
450	int i;	450	int i;
Lines 552-558 void FoFiTrueType::convertToType1(char * Link Here
552	}	552	}
553		553
554	void FoFiTrueType::convertToCIDType2(char *psName,	554	void FoFiTrueType::convertToCIDType2(char *psName,
555	Gushort *cidMap, int nCIDs,	555	Gushort *cidMap, SafeInt nCIDs,
556	GBool needVerticalMetrics,	556	GBool needVerticalMetrics,
557	FoFiOutputFunc outputFunc,	557	FoFiOutputFunc outputFunc,
558	void *outputStream) {	558	void *outputStream) {
Lines 586-592 void FoFiTrueType::convertToCIDType2(cha Link Here
586	(*outputFunc)(outputStream, " end def\n", 10);	586	(*outputFunc)(outputStream, " end def\n", 10);
587	(*outputFunc)(outputStream, "/GDBytes 2 def\n", 15);	587	(*outputFunc)(outputStream, "/GDBytes 2 def\n", 15);
588	if (cidMap) {	588	if (cidMap) {
589	buf = GooString::format("/CIDCount {0:d} def\n", nCIDs);	589	buf = GooString::format("/CIDCount {0:d} def\n", nCIDs.Int());
590	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	590	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
591	delete buf;	591	delete buf;
592	if (nCIDs > 32767) {	592	if (nCIDs > 32767) {
Lines 625-637 void FoFiTrueType::convertToCIDType2(cha Link Here
625	}	625	}
626	} else {	626	} else {
627	// direct mapping - just fill the string(s) with s[i]=i	627	// direct mapping - just fill the string(s) with s[i]=i
628	buf = GooString::format("/CIDCount {0:d} def\n", nGlyphs);	628	buf = GooString::format("/CIDCount {0:d} def\n", nGlyphs.Int());
629	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	629	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
630	delete buf;	630	delete buf;
631	if (nGlyphs > 32767) {	631	if (nGlyphs > 32767) {
632	(*outputFunc)(outputStream, "/CIDMap [\n", 10);	632	(*outputFunc)(outputStream, "/CIDMap [\n", 10);
633	for (i = 0; i < nGlyphs; i += 32767) {	633	for (i = 0; i < nGlyphs; i += 32767) {
634	j = nGlyphs - i < 32767 ? nGlyphs - i : 32767;	634	j = nGlyphs.Int() - i < 32767 ? nGlyphs.Int() - i : 32767;
635	buf = GooString::format(" {0:d} string 0 1 {1:d} {{\n", 2 * j, j - 1);	635	buf = GooString::format(" {0:d} string 0 1 {1:d} {{\n", 2 * j, j - 1);
636	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	636	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
637	delete buf;	637	delete buf;
Lines 647-656 void FoFiTrueType::convertToCIDType2(cha Link Here
647	}	647	}
648	(*outputFunc)(outputStream, "] def\n", 6);	648	(*outputFunc)(outputStream, "] def\n", 6);
649	} else {	649	} else {
650	buf = GooString::format("/CIDMap {0:d} string\n", 2 * nGlyphs);	650	buf = GooString::format("/CIDMap {0:d} string\n", 2 * nGlyphs.Int());
651	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	651	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
652	delete buf;	652	delete buf;
653	buf = GooString::format(" 0 1 {0:d} {{\n", nGlyphs - 1);	653	buf = GooString::format(" 0 1 {0:d} {{\n", nGlyphs.Int() - 1);
654	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());	654	(*outputFunc)(outputStream, buf->getCString(), buf->getLength());
655	delete buf;	655	delete buf;
656	(*outputFunc)(outputStream,	656	(*outputFunc)(outputStream,
Lines 702-708 void FoFiTrueType::convertToCIDType0(cha Link Here
702	delete ff;	702	delete ff;
703	}	703	}
704		704
705	void FoFiTrueType::convertToType0(char psName, Gushort cidMap, int nCIDs,	705	void FoFiTrueType::convertToType0(char psName, Gushort cidMap, SafeInt nCIDs,
706	GBool needVerticalMetrics,	706	GBool needVerticalMetrics,
707	FoFiOutputFunc outputFunc,	707	FoFiOutputFunc outputFunc,
708	void *outputStream) {	708	void *outputStream) {
Lines 720-726 void FoFiTrueType::convertToType0(char * Link Here
720	delete sfntsName;	720	delete sfntsName;
721		721
722	// write the descendant Type 42 fonts	722	// write the descendant Type 42 fonts
723	n = cidMap ? nCIDs : nGlyphs;	723	n = cidMap ? nCIDs.Int() : nGlyphs.Int();
724	for (i = 0; i < n; i += 256) {	724	for (i = 0; i < n; i += 256) {
725	(*outputFunc)(outputStream, "10 dict begin\n", 14);	725	(*outputFunc)(outputStream, "10 dict begin\n", 14);
726	(*outputFunc)(outputStream, "/FontName /", 11);	726	(*outputFunc)(outputStream, "/FontName /", 11);
Lines 884-895 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
884	};	884	};
885	GBool missingCmap, missingName, missingPost, missingOS2;	885	GBool missingCmap, missingName, missingPost, missingOS2;
886	GBool unsortedLoca, badCmapLen, abbrevHMTX;	886	GBool unsortedLoca, badCmapLen, abbrevHMTX;
887	int nZeroLengthTables;	887	SafeInt nZeroLengthTables;
888	int nHMetrics, advWidth, lsb;	888	int nHMetrics, advWidth, lsb;
889	TrueTypeLoca *locaTable;	889	TrueTypeLoca *locaTable;
890	TrueTypeTable *newTables;	890	TrueTypeTable *newTables;
891	char newNameTab, newCmapTab, newHHEATab, newHMTXTab;	891	char newNameTab, newCmapTab, newHHEATab, newHMTXTab;
892	int nNewTables, cmapIdx, cmapLen, glyfLen, newNameLen, newCmapLen, next;	892	SafeInt nNewTables;
		893	int cmapIdx, cmapLen, glyfLen, newNameLen, newCmapLen, next;
893	int newHHEALen, newHMTXLen;	894	int newHHEALen, newHMTXLen;
894	Guint locaChecksum, glyfChecksum, fileChecksum;	895	Guint locaChecksum, glyfChecksum, fileChecksum;
895	char *tableDir;	896	char *tableDir;
Lines 918-924 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
918	missingOS2 = seekTable("OS/2") < 0;	919	missingOS2 = seekTable("OS/2") < 0;
919		920
920	// read the loca table, check to see if it's sorted	921	// read the loca table, check to see if it's sorted
921	locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + 1, sizeof(TrueTypeLoca));	922	locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + SafeInt(1), sizeof(TrueTypeLoca));
922	unsortedLoca = gFalse;	923	unsortedLoca = gFalse;
923	i = seekTable("loca");	924	i = seekTable("loca");
924	pos = tables[i].offset;	925	pos = tables[i].offset;
Lines 997-1009 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
997	// the same pos value remain in the same order)	998	// the same pos value remain in the same order)
998	glyfLen = 0; // make gcc happy	999	glyfLen = 0; // make gcc happy
999	if (unsortedLoca) {	1000	if (unsortedLoca) {
1000	qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca),	1001	qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
1001	&cmpTrueTypeLocaOffset);	1002	&cmpTrueTypeLocaOffset);
1002	for (i = 0; i < nGlyphs; ++i) {	1003	for (i = 0; i < nGlyphs; ++i) {
1003	locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset;	1004	locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset;
1004	}	1005	}
1005	locaTable[nGlyphs].len = 0;	1006	locaTable[nGlyphs.Int()].len = 0;
1006	qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca),	1007	qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
1007	&cmpTrueTypeLocaIdx);	1008	&cmpTrueTypeLocaIdx);
1008	pos = 0;	1009	pos = 0;
1009	for (i = 0; i <= nGlyphs; ++i) {	1010	for (i = 0; i <= nGlyphs; ++i) {
Lines 1046-1052 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
1046	// construct the new name table	1047	// construct the new name table
1047	if (name) {	1048	if (name) {
1048	n = strlen(name);	1049	n = strlen(name);
1049	newNameLen = (6 + 412 + 2 (3*n + 7) + 3) & ~3;	1050	newNameLen = (6 + 412 + 2 (3*SafeInt(n) + 7) + 3).Int() & ~3;
1050	newNameTab = (char *)gmalloc(newNameLen);	1051	newNameTab = (char *)gmalloc(newNameLen);
1051	memset(newNameTab, 0, newNameLen);	1052	memset(newNameTab, 0, newNameLen);
1052	newNameTab[0] = 0; // format selector	1053	newNameTab[0] = 0; // format selector
Lines 1151-1161 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
1151	for (i = 0; i < newHHEALen; ++i) {	1152	for (i = 0; i < newHHEALen; ++i) {
1152	newHHEATab[i] = getU8(pos++, &ok);	1153	newHHEATab[i] = getU8(pos++, &ok);
1153	}	1154	}
1154	newHHEATab[34] = nGlyphs >> 8;	1155	newHHEATab[34] = nGlyphs.Int() >> 8;
1155	newHHEATab[35] = nGlyphs & 0xff;	1156	newHHEATab[35] = nGlyphs.Int() & 0xff;
1156	i = seekTable("hmtx");	1157	i = seekTable("hmtx");
1157	pos = tables[i].offset;	1158	pos = tables[i].offset;
1158	newHMTXLen = 4 * nGlyphs;	1159	newHMTXLen = (4 * nGlyphs).Int();
1159	newHMTXTab = (char *)gmalloc(newHMTXLen);	1160	newHMTXTab = (char *)gmalloc(newHMTXLen);
1160	advWidth = 0;	1161	advWidth = 0;
1161	for (i = 0; i < nHMetrics; ++i) {	1162	for (i = 0; i < nHMetrics; ++i) {
Lines 1211-1217 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
1211	} else if (newTables[j].tag == cmapTag && badCmapLen) {	1212	} else if (newTables[j].tag == cmapTag && badCmapLen) {
1212	newTables[j].len = cmapLen;	1213	newTables[j].len = cmapLen;
1213	} else if (newTables[j].tag == locaTag && unsortedLoca) {	1214	} else if (newTables[j].tag == locaTag && unsortedLoca) {
1214	newTables[j].len = (nGlyphs + 1) * (locaFmt ? 4 : 2);	1215	newTables[j].len = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2);
1215	newTables[j].checksum = locaChecksum;	1216	newTables[j].checksum = locaChecksum;
1216	} else if (newTables[j].tag == glyfTag && unsortedLoca) {	1217	} else if (newTables[j].tag == glyfTag && unsortedLoca) {
1217	newTables[j].len = glyfLen;	1218	newTables[j].len = glyfLen;
Lines 1272-1280 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
1272	newTables[j].len = sizeof(os2Tab);	1273	newTables[j].len = sizeof(os2Tab);
1273	++j;	1274	++j;
1274	}	1275	}
1275	qsort(newTables, nNewTables, sizeof(TrueTypeTable),	1276	qsort(newTables, nNewTables.Int(), sizeof(TrueTypeTable),
1276	&cmpTrueTypeTableTag);	1277	&cmpTrueTypeTableTag);
1277	pos = 12 + nNewTables * 16;	1278	pos = 12 + nNewTables.Int() * 16;
1278	for (i = 0; i < nNewTables; ++i) {	1279	for (i = 0; i < nNewTables; ++i) {
1279	newTables[i].offset = pos;	1280	newTables[i].offset = pos;
1280	pos += newTables[i].len;	1281	pos += newTables[i].len;
Lines 1284-1303 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
1284	}	1285	}
1285		1286
1286	// write the table directory	1287	// write the table directory
1287	tableDir = (char )gmalloc(12 + nNewTables 16);	1288	tableDir = (char )gmalloc((SafeInt(12) + nNewTables SafeInt(16)).Int());
1288	tableDir[0] = 0x00; // sfnt version	1289	tableDir[0] = 0x00; // sfnt version
1289	tableDir[1] = 0x01;	1290	tableDir[1] = 0x01;
1290	tableDir[2] = 0x00;	1291	tableDir[2] = 0x00;
1291	tableDir[3] = 0x00;	1292	tableDir[3] = 0x00;
1292	tableDir[4] = (char)((nNewTables >> 8) & 0xff); // numTables	1293	tableDir[4] = (char)((nNewTables.Int() >> 8) & 0xff); // numTables
1293	tableDir[5] = (char)(nNewTables & 0xff);	1294	tableDir[5] = (char)(nNewTables.Int() & 0xff);
1294	for (i = -1, t = (Guint)nNewTables; t; ++i, t >>= 1) ;	1295	for (i = -1, t = (Guint)nNewTables.Int(); t; ++i, t >>= 1) ;
1295	t = 1 << (4 + i);	1296	t = 1 << (4 + i);
1296	tableDir[6] = (char)((t >> 8) & 0xff); // searchRange	1297	tableDir[6] = (char)((t >> 8) & 0xff); // searchRange
1297	tableDir[7] = (char)(t & 0xff);	1298	tableDir[7] = (char)(t & 0xff);
1298	tableDir[8] = (char)((i >> 8) & 0xff); // entrySelector	1299	tableDir[8] = (char)((i >> 8) & 0xff); // entrySelector
1299	tableDir[9] = (char)(i & 0xff);	1300	tableDir[9] = (char)(i & 0xff);
1300	t = nNewTables * 16 - t;	1301	t = nNewTables.Int() * 16 - t;
1301	tableDir[10] = (char)((t >> 8) & 0xff); // rangeShift	1302	tableDir[10] = (char)((t >> 8) & 0xff); // rangeShift
1302	tableDir[11] = (char)(t & 0xff);	1303	tableDir[11] = (char)(t & 0xff);
1303	pos = 12;	1304	pos = 12;
Lines 1320-1330 void FoFiTrueType::writeTTF(FoFiOutputFu Link Here
1320	tableDir[pos+15] = (char) newTables[i].len;	1321	tableDir[pos+15] = (char) newTables[i].len;
1321	pos += 16;	1322	pos += 16;
1322	}	1323	}
1323	(outputFunc)(outputStream, tableDir, 12 + nNewTables 16);	1324	(outputFunc)(outputStream, tableDir, 12 + nNewTables.Int() 16);
1324		1325
1325	// compute the file checksum	1326	// compute the file checksum
1326	fileChecksum = computeTableChecksum((Guchar *)tableDir,	1327	fileChecksum = computeTableChecksum((Guchar *)tableDir,
1327	12 + nNewTables * 16);	1328	12 + nNewTables.Int() * 16);
1328	for (i = 0; i < nNewTables; ++i) {	1329	for (i = 0; i < nNewTables; ++i) {
1329	fileChecksum += newTables[i].checksum;	1330	fileChecksum += newTables[i].checksum;
1330	}	1331	}
Lines 1512-1518 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1512	Guchar tableDir[12 + nT42Tables*16];	1513	Guchar tableDir[12 + nT42Tables*16];
1513	GBool ok;	1514	GBool ok;
1514	Guint checksum;	1515	Guint checksum;
1515	int nNewTables;	1516	SafeInt nNewTables;
1516	int length, pos, glyfPos, i, j, k;	1517	int length, pos, glyfPos, i, j, k;
1517	Guchar vheaTab[36] = {	1518	Guchar vheaTab[36] = {
1518	0, 1, 0, 0, // table version number	1519	0, 1, 0, 0, // table version number
Lines 1556-1562 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1556	// table, cmpTrueTypeLocaPos uses offset as its primary sort key,	1557	// table, cmpTrueTypeLocaPos uses offset as its primary sort key,
1557	// and idx as its secondary key (ensuring that adjacent entries with	1558	// and idx as its secondary key (ensuring that adjacent entries with
1558	// the same pos value remain in the same order)	1559	// the same pos value remain in the same order)
1559	locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + 1, sizeof(TrueTypeLoca));	1560	locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + SafeInt(1), sizeof(TrueTypeLoca));
1560	i = seekTable("loca");	1561	i = seekTable("loca");
1561	pos = tables[i].offset;	1562	pos = tables[i].offset;
1562	ok = gTrue;	1563	ok = gTrue;
Lines 1568-1580 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1568	locaTable[i].origOffset = 2 * getU16BE(pos + i*2, &ok);	1569	locaTable[i].origOffset = 2 * getU16BE(pos + i*2, &ok);
1569	}	1570	}
1570	}	1571	}
1571	qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca),	1572	qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
1572	&cmpTrueTypeLocaOffset);	1573	&cmpTrueTypeLocaOffset);
1573	for (i = 0; i < nGlyphs; ++i) {	1574	for (i = 0; i < nGlyphs; ++i) {
1574	locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset;	1575	locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset;
1575	}	1576	}
1576	locaTable[nGlyphs].len = 0;	1577	locaTable[nGlyphs.Int()].len = 0;
1577	qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca),	1578	qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca),
1578	&cmpTrueTypeLocaIdx);	1579	&cmpTrueTypeLocaIdx);
1579	pos = 0;	1580	pos = 0;
1580	for (i = 0; i <= nGlyphs; ++i) {	1581	for (i = 0; i <= nGlyphs; ++i) {
Lines 1586-1592 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1586	}	1587	}
1587		1588
1588	// construct the new 'loca' table	1589	// construct the new 'loca' table
1589	locaData = (Guchar *)gmallocn(nGlyphs + 1, (locaFmt ? 4 : 2));	1590	locaData = (Guchar *)gmallocn(nGlyphs + SafeInt(1), (locaFmt ? 4 : 2));
1590	for (i = 0; i <= nGlyphs; ++i) {	1591	for (i = 0; i <= nGlyphs; ++i) {
1591	pos = locaTable[i].newOffset;	1592	pos = locaTable[i].newOffset;
1592	if (locaFmt) {	1593	if (locaFmt) {
Lines 1627-1633 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1627		1628
1628	// construct the new table headers, including table checksums	1629	// construct the new table headers, including table checksums
1629	// (pad each table out to a multiple of 4 bytes)	1630	// (pad each table out to a multiple of 4 bytes)
1630	pos = 12 + nNewTables*16;	1631	pos = 12 + nNewTables.Int()*16;
1631	k = 0;	1632	k = 0;
1632	for (i = 0; i < nT42Tables; ++i) {	1633	for (i = 0; i < nT42Tables; ++i) {
1633	length = -1;	1634	length = -1;
Lines 1636-1642 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1636	length = 54;	1637	length = 54;
1637	checksum = computeTableChecksum(headData, 54);	1638	checksum = computeTableChecksum(headData, 54);
1638	} else if (i == t42LocaTable) {	1639	} else if (i == t42LocaTable) {
1639	length = (nGlyphs + 1) * (locaFmt ? 4 : 2);	1640	length = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2);
1640	checksum = computeTableChecksum(locaData, length);	1641	checksum = computeTableChecksum(locaData, length);
1641	} else if (i == t42GlyfTable) {	1642	} else if (i == t42GlyfTable) {
1642	length = 0;	1643	length = 0;
Lines 1665-1671 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1665	length = sizeof(vheaTab);	1666	length = sizeof(vheaTab);
1666	checksum = computeTableChecksum(vheaTab, length);	1667	checksum = computeTableChecksum(vheaTab, length);
1667	} else if (needVerticalMetrics && i == t42VmtxTable) {	1668	} else if (needVerticalMetrics && i == t42VmtxTable) {
1668	length = 4 + (nGlyphs - 1) * 4;	1669	length = (4 + (nGlyphs - 1) * 4).Int();
1669	vmtxTab = (Guchar *)gmalloc(length);	1670	vmtxTab = (Guchar *)gmalloc(length);
1670	vmtxTab[0] = advance / 256;	1671	vmtxTab[0] = advance / 256;
1671	vmtxTab[1] = advance % 256;	1672	vmtxTab[1] = advance % 256;
Lines 1703-1715 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1703	tableDir[2] = 0x00;	1704	tableDir[2] = 0x00;
1704	tableDir[3] = 0x00;	1705	tableDir[3] = 0x00;
1705	tableDir[4] = 0; // numTables	1706	tableDir[4] = 0; // numTables
1706	tableDir[5] = nNewTables;	1707	tableDir[5] = nNewTables.Int();
1707	tableDir[6] = 0; // searchRange	1708	tableDir[6] = 0; // searchRange
1708	tableDir[7] = (Guchar)128;	1709	tableDir[7] = (Guchar)128;
1709	tableDir[8] = 0; // entrySelector	1710	tableDir[8] = 0; // entrySelector
1710	tableDir[9] = 3;	1711	tableDir[9] = 3;
1711	tableDir[10] = 0; // rangeShift	1712	tableDir[10] = 0; // rangeShift
1712	tableDir[11] = (Guchar)(16 * nNewTables - 128);	1713	tableDir[11] = (Guchar)(16 * nNewTables.Int() - 128);
1713	pos = 12;	1714	pos = 12;
1714	for (i = 0; i < nNewTables; ++i) {	1715	for (i = 0; i < nNewTables; ++i) {
1715	tableDir[pos ] = (Guchar)(newTables[i].tag >> 24);	1716	tableDir[pos ] = (Guchar)(newTables[i].tag >> 24);
Lines 1732-1738 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1732	}	1733	}
1733		1734
1734	// compute the font checksum and store it in the head table	1735	// compute the font checksum and store it in the head table
1735	checksum = computeTableChecksum(tableDir, 12 + nNewTables*16);	1736	checksum = computeTableChecksum(tableDir, 12 + nNewTables.Int()*16);
1736	for (i = 0; i < nNewTables; ++i) {	1737	for (i = 0; i < nNewTables; ++i) {
1737	checksum += newTables[i].checksum;	1738	checksum += newTables[i].checksum;
1738	}	1739	}
Lines 1752-1765 void FoFiTrueType::cvtSfnts(FoFiOutputFu Link Here
1752	}	1753	}
1753		1754
1754	// write the table directory	1755	// write the table directory
1755	dumpString(tableDir, 12 + nNewTables*16, outputFunc, outputStream);	1756	dumpString(tableDir, 12 + nNewTables.Int()*16, outputFunc, outputStream);
1756		1757
1757	// write the tables	1758	// write the tables
1758	for (i = 0; i < nNewTables; ++i) {	1759	for (i = 0; i < nNewTables; ++i) {
1759	if (i == t42HeadTable) {	1760	if (i == t42HeadTable) {
1760	dumpString(headData, 54, outputFunc, outputStream);	1761	dumpString(headData, 54, outputFunc, outputStream);
1761	} else if (i == t42LocaTable) {	1762	} else if (i == t42LocaTable) {
1762	length = (nGlyphs + 1) * (locaFmt ? 4 : 2);	1763	length = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2);
1763	dumpString(locaData, length, outputFunc, outputStream);	1764	dumpString(locaData, length, outputFunc, outputStream);
1764	} else if (i == t42GlyfTable) {	1765	} else if (i == t42GlyfTable) {
1765	glyfPos = tables[seekTable("glyf")].offset;	1766	glyfPos = tables[seekTable("glyf")].offset;
Lines 1983-1989 void FoFiTrueType::parse() { Link Here
1983	parsedOk = gFalse;	1984	parsedOk = gFalse;
1984	return;	1985	return;
1985	}	1986	}
1986	if (tables[i].len < (nGlyphs + 1) * (locaFmt ? 4 : 2)) {	1987	if (tables[i].len < (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2)) {
1987	nGlyphs = tables[i].len / (locaFmt ? 4 : 2) - 1;	1988	nGlyphs = tables[i].len / (locaFmt ? 4 : 2) - 1;
1988	}	1989	}
1989	for (j = 0; j <= nGlyphs; ++j) {	1990	for (j = 0; j <= nGlyphs; ++j) {
Lines 2032-2038 void FoFiTrueType::readPostTable() { Link Here
2032	goto err;	2033	goto err;
2033	}	2034	}
2034	if (n > nGlyphs) {	2035	if (n > nGlyphs) {
2035	n = nGlyphs;	2036	n = nGlyphs.Int();
2036	}	2037	}
2037	stringIdx = 0;	2038	stringIdx = 0;
2038	stringPos = tablePos + 34 + 2*n;	2039	stringPos = tablePos + 34 + 2*n;

Lines 83-89 public: Link Here

(-)poppler-0.12.0/fofi/FoFiTrueType.h (-5 / +5 lines)
83	// Return the mapping from CIDs to GIDs, and return the number of	83	// Return the mapping from CIDs to GIDs, and return the number of
84	// CIDs in *<nCIDs>. This is only useful for CID fonts. (Only	84	// CIDs in *<nCIDs>. This is only useful for CID fonts. (Only
85	// useful for OpenType CFF fonts.)	85	// useful for OpenType CFF fonts.)
86	Gushort getCIDToGIDMap(int nCIDs);	86	Gushort getCIDToGIDMap(SafeInt nCIDs);
87		87
88	// Returns the least restrictive embedding licensing right (as	88	// Returns the least restrictive embedding licensing right (as
89	// defined by the TrueType spec):	89	// defined by the TrueType spec):
Lines 120-126 public: Link Here
120	// name (so we don't need to depend on the 'name' table in the	120	// name (so we don't need to depend on the 'name' table in the
121	// font). The <cidMap> array maps CIDs to GIDs; it has <nCIDs>	121	// font). The <cidMap> array maps CIDs to GIDs; it has <nCIDs>
122	// entries. (Not useful for OpenType CFF fonts.)	122	// entries. (Not useful for OpenType CFF fonts.)
123	void convertToCIDType2(char psName, Gushort cidMap, int nCIDs,	123	void convertToCIDType2(char psName, Gushort cidMap, SafeInt nCIDs,
124	GBool needVerticalMetrics,	124	GBool needVerticalMetrics,
125	FoFiOutputFunc outputFunc, void *outputStream);	125	FoFiOutputFunc outputFunc, void *outputStream);
126		126
Lines 135-141 public: Link Here
135	// PostScript font name (so we don't need to depend on the 'name'	135	// PostScript font name (so we don't need to depend on the 'name'
136	// table in the font). The <cidMap> array maps CIDs to GIDs; it has	136	// table in the font). The <cidMap> array maps CIDs to GIDs; it has
137	// <nCIDs> entries. (Not useful for OpenType CFF fonts.)	137	// <nCIDs> entries. (Not useful for OpenType CFF fonts.)
138	void convertToType0(char psName, Gushort cidMap, int nCIDs,	138	void convertToType0(char psName, Gushort cidMap, SafeInt nCIDs,
139	GBool needVerticalMetrics,	139	GBool needVerticalMetrics,
140	FoFiOutputFunc outputFunc, void *outputStream);	140	FoFiOutputFunc outputFunc, void *outputStream);
141		141
Lines 182-191 private: Link Here
182	int checkGIDInCoverage(Guint coverage, Guint orgGID);	182	int checkGIDInCoverage(Guint coverage, Guint orgGID);
183		183
184	TrueTypeTable *tables;	184	TrueTypeTable *tables;
185	int nTables;	185	SafeInt nTables;
186	TrueTypeCmap *cmaps;	186	TrueTypeCmap *cmaps;
187	int nCmaps;	187	int nCmaps;
188	int nGlyphs;	188	SafeInt nGlyphs;
189	int locaFmt;	189	int locaFmt;
190	int bbox[4];	190	int bbox[4];
191	GooHash *nameToGID;	191	GooHash *nameToGID;

Lines 311-317 void GooHash::killIter(GooHashIter **ite Link Here

(-)poppler-0.12.0/goo/GooHash.cc (-3 / +4 lines)
311	void GooHash::expand() {	311	void GooHash::expand() {
312	GooHashBucket **oldTab;	312	GooHashBucket **oldTab;
313	GooHashBucket *p;	313	GooHashBucket *p;
314	int oldSize, h, i;	314	int h, i;
		315	SafeInt oldSize;
315		316
316	oldSize = size;	317	oldSize = size;
317	oldTab = tab;	318	oldTab = tab;
Lines 365-371 int GooHash::hash(GooString *key) { Link Here
365	for (p = key->getCString(), i = 0; i < key->getLength(); ++p, ++i) {	366	for (p = key->getCString(), i = 0; i < key->getLength(); ++p, ++i) {
366	h = 17 * h + (int)(*p & 0xff);	367	h = 17 * h + (int)(*p & 0xff);
367	}	368	}
368	return (int)(h % size);	369	return (int)(h % size.Int());
369	}	370	}
370		371
371	int GooHash::hash(char *key) {	372	int GooHash::hash(char *key) {
Lines 376-380 int GooHash::hash(char *key) { Link Here
376	for (p = key; *p; ++p) {	377	for (p = key; *p; ++p) {
377	h = 17 * h + (int)(*p & 0xff);	378	h = 17 * h + (int)(*p & 0xff);
378	}	379	}
379	return (int)(h % size);	380	return (int)(h % size.Int());
380	}	381	}

Lines 43-49 void GooList::append(void *p) { Link Here

(-)poppler-0.12.0/goo/GooList.cc (-5 / +5 lines)
43	if (length >= size) {	43	if (length >= size) {
44	expand();	44	expand();
45	}	45	}
46	data[length++] = p;	46	data[(length++).Int()] = p;
47	}	47	}
48		48
49	void GooList::append(GooList *list) {	49	void GooList::append(GooList *list) {
Lines 53-59 void GooList::append(GooList *list) { Link Here
53	expand();	53	expand();
54	}	54	}
55	for (i = 0; i < list->length; ++i) {	55	for (i = 0; i < list->length; ++i) {
56	data[length++] = list->data[i];	56	data[(length++).Int()] = list->data[i];
57	}	57	}
58	}	58	}
59		59
Lines 62-68 void GooList::insert(int i, void *p) { Link Here
62	expand();	62	expand();
63	}	63	}
64	if (i < length) {	64	if (i < length) {
65	memmove(data+i+1, data+i, (length - i) * sizeof(void *));	65	memmove(data+i+1, data+i, (length.Int() - i) * sizeof(void *));
66	}	66	}
67	data[i] = p;	67	data[i] = p;
68	++length;	68	++length;
Lines 73-79 void *GooList::del(int i) { Link Here
73		73
74	p = data[i];	74	p = data[i];
75	if (i < length - 1) {	75	if (i < length - 1) {
76	memmove(data+i, data+i+1, (length - i - 1) * sizeof(void *));	76	memmove(data+i, data+i+1, (length.Int() - i - 1) * sizeof(void *));
77	}	77	}
78	--length;	78	--length;
79	if (size - length >= ((inc > 0) ? inc : size/2)) {	79	if (size - length >= ((inc > 0) ? inc : size/2)) {
Lines 83-89 void *GooList::del(int i) { Link Here
83	}	83	}
84		84
85	void GooList::sort(int (cmp)(const void obj1, const void *obj2)) {	85	void GooList::sort(int (cmp)(const void obj1, const void *obj2)) {
86	qsort(data, length, sizeof(void *), cmp);	86	qsort(data, length.Int(), sizeof(void *), cmp);
87	}	87	}
88		88
89	void GooList::expand() {	89	void GooList::expand() {

Lines 14-19 Link Here

(-)poppler-0.12.0/goo/GooList.h (-4 / +5 lines)
14	#endif	14	#endif
15		15
16	#include "gtypes.h"	16	#include "gtypes.h"
		17	#include "gmem.h"
17		18
18	//------------------------------------------------------------------------	19	//------------------------------------------------------------------------
19	// GooList	20	// GooList
Lines 34-40 public: Link Here
34	//----- general	35	//----- general
35		36
36	// Get the number of elements.	37	// Get the number of elements.
37	int getLength() { return length; }	38	int getLength() { return length.Int(); }
38		39
39	//----- ordered list support	40	//----- ordered list support
40		41
Lines 74-82 private: Link Here
74	void shrink();	75	void shrink();
75		76
76	void **data; // the list elements	77	void **data; // the list elements
77	int size; // size of data array	78	SafeInt size; // size of data array
78	int length; // number of elements on list	79	SafeInt length; // number of elements on list
79	int inc; // allocation increment	80	SafeInt inc; // allocation increment
80	};	81	};
81		82
82	#define deleteGooList(list, T) \	83	#define deleteGooList(list, T) \

Lines 89-95 public: Link Here

(-)poppler-0.12.0/splash/SplashPath.h (-3 / +3 lines)
89	void offset(SplashCoord dx, SplashCoord dy);	89	void offset(SplashCoord dx, SplashCoord dy);
90		90
91	// Get the points on the path.	91	// Get the points on the path.
92	int getLength() { return length; }	92	int getLength() { return length.Int(); }
93	void getPoint(int i, double x, double y, Guchar *f)	93	void getPoint(int i, double x, double y, Guchar *f)
94	{ x = pts[i].x; y = pts[i].y; *f = flags[i]; }	94	{ x = pts[i].x; y = pts[i].y; *f = flags[i]; }
95		95
Lines 106-116 protected: Link Here
106		106
107	SplashPathPoint *pts; // array of points	107	SplashPathPoint *pts; // array of points
108	Guchar *flags; // array of flags	108	Guchar *flags; // array of flags
109	int length, size; // length/size of the pts and flags arrays	109	SafeInt length, size; // length/size of the pts and flags arrays
110	int curSubpath; // index of first point in last subpath	110	int curSubpath; // index of first point in last subpath
111		111
112	SplashPathHint *hints; // list of hints	112	SplashPathHint *hints; // list of hints
113	int hintsLength, hintsSize;	113	SafeInt hintsLength, hintsSize;
114		114
115	friend class SplashXPath;	115	friend class SplashXPath;
116	friend class Splash;	116	friend class Splash;

Lines 55-61 SplashClip::SplashClip(SplashCoord x0, S Link Here

(-)poppler-0.12.0/splash/SplashClip.cc (-2 / +4 lines)
55	paths = NULL;	55	paths = NULL;
56	flags = NULL;	56	flags = NULL;
57	scanners = NULL;	57	scanners = NULL;
58	length = size = 0;	58	length = 0;
		59	size = 0;
59	}	60	}
60		61
61	SplashClip::SplashClip(SplashClip *clip) {	62	SplashClip::SplashClip(SplashClip *clip) {
Lines 124-130 void SplashClip::resetToRect(SplashCoord Link Here
124	paths = NULL;	125	paths = NULL;
125	flags = NULL;	126	flags = NULL;
126	scanners = NULL;	127	scanners = NULL;
127	length = size = 0;	128	length = 0;
		129	size = 0;
128		130
129	if (x0 < x1) {	131	if (x0 < x1) {
130	xMin = x0;	132	xMin = x0;

Lines 106-112 SplashFontFile *SplashFTFontEngine::load Link Here

(-)poppler-0.12.0/splash/SplashFTFontEngine.cc (-4 / +4 lines)
106	SplashFontSrc *src) {	106	SplashFontSrc *src) {
107	FoFiType1C *ff;	107	FoFiType1C *ff;
108	Gushort *cidToGIDMap;	108	Gushort *cidToGIDMap;
109	int nCIDs;	109	SafeInt nCIDs;
110	SplashFontFile *ret;	110	SplashFontFile *ret;
111		111
112	// check for a CFF font	112	// check for a CFF font
Lines 127-133 SplashFontFile *SplashFTFontEngine::load Link Here
127	nCIDs = 0;	127	nCIDs = 0;
128	}	128	}
129	}	129	}
130	ret = SplashFTFontFile::loadCIDFont(this, idA, src, cidToGIDMap, nCIDs);	130	ret = SplashFTFontFile::loadCIDFont(this, idA, src, cidToGIDMap, nCIDs.Int());
131	if (!ret) {	131	if (!ret) {
132	gfree(cidToGIDMap);	132	gfree(cidToGIDMap);
133	}	133	}
Lines 139-145 SplashFontFile *SplashFTFontEngine::load Link Here
139	FoFiTrueType *ff;	139	FoFiTrueType *ff;
140	GBool isCID;	140	GBool isCID;
141	Gushort *cidToGIDMap;	141	Gushort *cidToGIDMap;
142	int nCIDs;	142	SafeInt nCIDs;
143	SplashFontFile *ret;	143	SplashFontFile *ret;
144		144
145	cidToGIDMap = NULL;	145	cidToGIDMap = NULL;
Lines 159-165 SplashFontFile *SplashFTFontEngine::load Link Here
159	}	159	}
160	}	160	}
161	ret = SplashFTFontFile::loadCIDFont(this, idA, src,	161	ret = SplashFTFontFile::loadCIDFont(this, idA, src,
162	cidToGIDMap, nCIDs);	162	cidToGIDMap, nCIDs.Int());
163	if (!ret) {	163	if (!ret) {
164	gfree(cidToGIDMap);	164	gfree(cidToGIDMap);
165	}	165	}

Lines 93-99 void SplashFont::initCache() { Link Here

(-)poppler-0.12.0/splash/SplashFont.cc (-3 / +3 lines)
93	cacheTags = (SplashFontCacheTag )gmallocn(cacheSets cacheAssoc,	93	cacheTags = (SplashFontCacheTag )gmallocn(cacheSets cacheAssoc,
94	sizeof(SplashFontCacheTag));	94	sizeof(SplashFontCacheTag));
95	for (i = 0; i < cacheSets * cacheAssoc; ++i) {	95	for (i = 0; i < cacheSets * cacheAssoc; ++i) {
96	cacheTags[i].mru = i & (cacheAssoc - 1);	96	cacheTags[i].mru = i & (cacheAssoc.Int() - 1);
97	}	97	}
98	} else {	98	} else {
99	cacheAssoc = 0;	99	cacheAssoc = 0;
Lines 124-130 GBool SplashFont::getGlyph(int c, int xF Link Here
124	}	124	}
125		125
126	// check the cache	126	// check the cache
127	i = (c & (cacheSets - 1)) * cacheAssoc;	127	i = (c & (cacheSets.Int() - 1)) * cacheAssoc.Int();
128	for (j = 0; j < cacheAssoc; ++j) {	128	for (j = 0; j < cacheAssoc; ++j) {
129	if ((cacheTags[i+j].mru & 0x80000000) &&	129	if ((cacheTags[i+j].mru & 0x80000000) &&
130	cacheTags[i+j].c == c &&	130	cacheTags[i+j].c == c &&
Lines 189-195 GBool SplashFont::getGlyph(int c, int xF Link Here
189	else	189	else
190	{	190	{
191	for (j = 0; j < cacheAssoc; ++j) {	191	for (j = 0; j < cacheAssoc; ++j) {
192	if ((cacheTags[i+j].mru & 0x7fffffff) == cacheAssoc - 1) {	192	if ((cacheTags[i+j].mru & 0x7fffffff) == cacheAssoc.Int() - 1) {
193	cacheTags[i+j].mru = 0x80000000;	193	cacheTags[i+j].mru = 0x80000000;
194	cacheTags[i+j].c = c;	194	cacheTags[i+j].c = c;
195	cacheTags[i+j].xFrac = (short)xFrac;	195	cacheTags[i+j].xFrac = (short)xFrac;

Lines 44-56 SplashPath::SplashPath(SplashPath *path) Link Here

(-)poppler-0.12.0/splash/SplashPath.cc (-37 / +37 lines)
44	size = path->size;	44	size = path->size;
45	pts = (SplashPathPoint *)gmallocn(size, sizeof(SplashPathPoint));	45	pts = (SplashPathPoint *)gmallocn(size, sizeof(SplashPathPoint));
46	flags = (Guchar *)gmallocn(size, sizeof(Guchar));	46	flags = (Guchar *)gmallocn(size, sizeof(Guchar));
47	memcpy(pts, path->pts, length * sizeof(SplashPathPoint));	47	memcpy(pts, path->pts, length.Int() * sizeof(SplashPathPoint));
48	memcpy(flags, path->flags, length * sizeof(Guchar));	48	memcpy(flags, path->flags, length.Int() * sizeof(Guchar));
49	curSubpath = path->curSubpath;	49	curSubpath = path->curSubpath;
50	if (path->hints) {	50	if (path->hints) {
51	hintsLength = hintsSize = path->hintsLength;	51	hintsLength = hintsSize = path->hintsLength;
52	hints = (SplashPathHint *)gmallocn(hintsSize, sizeof(SplashPathHint));	52	hints = (SplashPathHint *)gmallocn(hintsSize, sizeof(SplashPathHint));
53	memcpy(hints, path->hints, hintsLength * sizeof(SplashPathHint));	53	memcpy(hints, path->hints, hintsLength.Int() * sizeof(SplashPathHint));
54	} else {	54	} else {
55	hints = NULL;	55	hints = NULL;
56	}	56	}
Lines 79-89 void SplashPath::grow(int nPts) { Link Here
79	void SplashPath::append(SplashPath *path) {	79	void SplashPath::append(SplashPath *path) {
80	int i;	80	int i;
81		81
82	curSubpath = length + path->curSubpath;	82	curSubpath = length.Int() + path->curSubpath;
83	grow(path->length);	83	grow(path->length.Int());
84	for (i = 0; i < path->length; ++i) {	84	for (i = 0; i < path->length; ++i) {
85	pts[length] = path->pts[i];	85	pts[length.Int()] = path->pts[i];
86	flags[length] = path->flags[i];	86	flags[length.Int()] = path->flags[i];
87	++length;	87	++length;
88	}	88	}
89	}	89	}
Lines 93-102 SplashError SplashPath::moveTo(SplashCoo Link Here
93	return splashErrBogusPath;	93	return splashErrBogusPath;
94	}	94	}
95	grow(1);	95	grow(1);
96	pts[length].x = x;	96	pts[length.Int()].x = x;
97	pts[length].y = y;	97	pts[length.Int()].y = y;
98	flags[length] = splashPathFirst \| splashPathLast;	98	flags[length.Int()] = splashPathFirst \| splashPathLast;
99	curSubpath = length++;	99	curSubpath = (length++).Int();
100	return splashOk;	100	return splashOk;
101	}	101	}
102		102
Lines 104-114 SplashError SplashPath::lineTo(SplashCoo Link Here
104	if (noCurrentPoint()) {	104	if (noCurrentPoint()) {
105	return splashErrNoCurPt;	105	return splashErrNoCurPt;
106	}	106	}
107	flags[length-1] &= ~splashPathLast;	107	flags[(length-1).Int()] &= ~splashPathLast;
108	grow(1);	108	grow(1);
109	pts[length].x = x;	109	pts[length.Int()].x = x;
110	pts[length].y = y;	110	pts[length.Int()].y = y;
111	flags[length] = splashPathLast;	111	flags[length.Int()] = splashPathLast;
112	++length;	112	++length;
113	return splashOk;	113	return splashOk;
114	}	114	}
Lines 119-137 SplashError SplashPath::curveTo(SplashCo Link Here
119	if (noCurrentPoint()) {	119	if (noCurrentPoint()) {
120	return splashErrNoCurPt;	120	return splashErrNoCurPt;
121	}	121	}
122	flags[length-1] &= ~splashPathLast;	122	flags[(length-1).Int()] &= ~splashPathLast;
123	grow(3);	123	grow(3);
124	pts[length].x = x1;	124	pts[length.Int()].x = x1;
125	pts[length].y = y1;	125	pts[length.Int()].y = y1;
126	flags[length] = splashPathCurve;	126	flags[length.Int()] = splashPathCurve;
127	++length;	127	++length;
128	pts[length].x = x2;	128	pts[length.Int()].x = x2;
129	pts[length].y = y2;	129	pts[length.Int()].y = y2;
130	flags[length] = splashPathCurve;	130	flags[length.Int()] = splashPathCurve;
131	++length;	131	++length;
132	pts[length].x = x3;	132	pts[length.Int()].x = x3;
133	pts[length].y = y3;	133	pts[length.Int()].y = y3;
134	flags[length] = splashPathLast;	134	flags[length.Int()] = splashPathLast;
135	++length;	135	++length;
136	return splashOk;	136	return splashOk;
137	}	137	}
Lines 140-167 SplashError SplashPath::close() { Link Here
140	if (noCurrentPoint()) {	140	if (noCurrentPoint()) {
141	return splashErrNoCurPt;	141	return splashErrNoCurPt;
142	}	142	}
143	if (curSubpath == length - 1 \|\|	143	if (curSubpath == length.Int() - 1 \|\|
144	pts[length - 1].x != pts[curSubpath].x \|\|	144	pts[length.Int() - 1].x != pts[curSubpath].x \|\|
145	pts[length - 1].y != pts[curSubpath].y) {	145	pts[length.Int() - 1].y != pts[curSubpath].y) {
146	lineTo(pts[curSubpath].x, pts[curSubpath].y);	146	lineTo(pts[curSubpath].x, pts[curSubpath].y);
147	}	147	}
148	flags[curSubpath] \|= splashPathClosed;	148	flags[curSubpath] \|= splashPathClosed;
149	flags[length - 1] \|= splashPathClosed;	149	flags[length.Int() - 1] \|= splashPathClosed;
150	curSubpath = length;	150	curSubpath = length.Int();
151	return splashOk;	151	return splashOk;
152	}	152	}
153		153
154	void SplashPath::addStrokeAdjustHint(int ctrl0, int ctrl1,	154	void SplashPath::addStrokeAdjustHint(int ctrl0, int ctrl1,
155	int firstPt, int lastPt) {	155	int firstPt, int lastPt) {
156	if (hintsLength == hintsSize) {	156	if (hintsLength == hintsSize) {
157	hintsSize = hintsLength ? 2 * hintsLength : 8;	157	hintsSize = hintsLength.Int() ? 2 * hintsLength : 8;
158	hints = (SplashPathHint *)greallocn(hints, hintsSize,	158	hints = (SplashPathHint *)greallocn(hints, hintsSize,
159	sizeof(SplashPathHint));	159	sizeof(SplashPathHint));
160	}	160	}
161	hints[hintsLength].ctrl0 = ctrl0;	161	hints[hintsLength.Int()].ctrl0 = ctrl0;
162	hints[hintsLength].ctrl1 = ctrl1;	162	hints[hintsLength.Int()].ctrl1 = ctrl1;
163	hints[hintsLength].firstPt = firstPt;	163	hints[hintsLength.Int()].firstPt = firstPt;
164	hints[hintsLength].lastPt = lastPt;	164	hints[hintsLength.Int()].lastPt = lastPt;
165	++hintsLength;	165	++hintsLength;
166	}	166	}
167		167
Lines 178-184 GBool SplashPath::getCurPt(SplashCoord * Link Here
178	if (noCurrentPoint()) {	178	if (noCurrentPoint()) {
179	return gFalse;	179	return gFalse;
180	}	180	}
181	*x = pts[length - 1].x;	181	*x = pts[length.Int() - 1].x;
182	*y = pts[length - 1].y;	182	*y = pts[length.Int() - 1].y;
183	return gTrue;	183	return gTrue;
184	}	184	}

Lines 59-65 SplashScreen::SplashScreen(SplashScreenP Link Here

(-)poppler-0.12.0/splash/SplashScreen.cc (-51 / +52 lines)
59	// size must be a power of 2	59	// size must be a power of 2
60	for (size = 1; size < params->size; size <<= 1) ;	60	for (size = 1; size < params->size; size <<= 1) ;
61	mat = (Guchar )gmallocn(size size, sizeof(Guchar));	61	mat = (Guchar )gmallocn(size size, sizeof(Guchar));
62	buildDispersedMatrix(size/2, size/2, 1, size/2, 1);	62	buildDispersedMatrix((size/2).Int(), (size/2).Int(), 1, (size/2).Int(), 1);
63	break;	63	break;
64		64
65	case splashScreenClustered:	65	case splashScreenClustered:
Lines 74-81 SplashScreen::SplashScreen(SplashScreenP Link Here
74		74
75	case splashScreenStochasticClustered:	75	case splashScreenStochasticClustered:
76	// size must be at least 2*r	76	// size must be at least 2*r
77	if (params->size < 2 * params->dotRadius) {	77	if (SafeInt(params->size) < 2 * SafeInt(params->dotRadius)) {
78	size = 2 * params->dotRadius;	78	size = 2 * SafeInt(params->dotRadius);
79	} else {	79	} else {
80	size = params->size;	80	size = params->size;
81	}	81	}
Lines 118-132 void SplashScreen::buildDispersedMatrix( Link Here
118	int delta, int offset) {	118	int delta, int offset) {
119	if (delta == 0) {	119	if (delta == 0) {
120	// map values in [1, size^2] --> [1, 255]	120	// map values in [1, size^2] --> [1, 255]
121	mat[i * size + j] = 1 + (254 * (val - 1)) / (size * size - 1);	121	mat[i * size.Int() + j] = 1 + (254 * (val - 1)) / (size.Int() * size.Int() - 1);
122	} else {	122	} else {
123	buildDispersedMatrix(i, j,	123	buildDispersedMatrix(i, j,
124	val, delta / 2, 4*offset);	124	val, delta / 2, 4*offset);
125	buildDispersedMatrix((i + delta) % size, (j + delta) % size,	125	buildDispersedMatrix((i + delta) % size.Int(), (j + delta) % size.Int(),
126	val + offset, delta / 2, 4*offset);	126	val + offset, delta / 2, 4*offset);
127	buildDispersedMatrix((i + delta) % size, j,	127	buildDispersedMatrix((i + delta) % size.Int(), j,
128	val + 2offset, delta / 2, 4offset);	128	val + 2offset, delta / 2, 4offset);
129	buildDispersedMatrix((i + 2*delta) % size, (j + delta) % size,	129	buildDispersedMatrix((i + 2*delta) % size.Int(), (j + delta) % size.Int(),
130	val + 3offset, delta / 2, 4offset);	130	val + 3offset, delta / 2, 4offset);
131	}	131	}
132	}	132	}
Lines 135-148 void SplashScreen::buildClusteredMatrix( Link Here
135	SplashCoord *dist;	135	SplashCoord *dist;
136	SplashCoord u, v, d;	136	SplashCoord u, v, d;
137	Guchar val;	137	Guchar val;
138	int size2, x, y, x1, y1, i;	138	SafeInt size2;
		139	int x, y, x1, y1, i;
139		140
140	size2 = size >> 1;	141	size2 = size >> 1;
141		142
142	// initialize the threshold matrix	143	// initialize the threshold matrix
143	for (y = 0; y < size; ++y) {	144	for (y = 0; y < size; ++y) {
144	for (x = 0; x < size; ++x) {	145	for (x = 0; x < size; ++x) {
145	mat[y * size + x] = 0;	146	mat[y * size.Int() + x] = 0;
146	}	147	}
147	}	148	}
148		149
Lines 154-175 void SplashScreen::buildClusteredMatrix( Link Here
154	u = (SplashCoord)x + 0.5 - 0;	155	u = (SplashCoord)x + 0.5 - 0;
155	v = (SplashCoord)y + 0.5 - 0;	156	v = (SplashCoord)y + 0.5 - 0;
156	} else {	157	} else {
157	u = (SplashCoord)x + 0.5 - (SplashCoord)size2;	158	u = (SplashCoord)x + 0.5 - (SplashCoord)size2.Int();
158	v = (SplashCoord)y + 0.5 - (SplashCoord)size2;	159	v = (SplashCoord)y + 0.5 - (SplashCoord)size2.Int();
159	}	160	}
160	dist[y * size2 + x] = uu + vv;	161	dist[y * size2.Int() + x] = uu + vv;
161	}	162	}
162	}	163	}
163	for (y = 0; y < size2; ++y) {	164	for (y = 0; y < size2; ++y) {
164	for (x = 0; x < size2; ++x) {	165	for (x = 0; x < size2; ++x) {
165	if (x < y) {	166	if (x < y) {
166	u = (SplashCoord)x + 0.5 - 0;	167	u = (SplashCoord)x + 0.5 - 0;
167	v = (SplashCoord)y + 0.5 - (SplashCoord)size2;	168	v = (SplashCoord)y + 0.5 - (SplashCoord)size2.Int();
168	} else {	169	} else {
169	u = (SplashCoord)x + 0.5 - (SplashCoord)size2;	170	u = (SplashCoord)x + 0.5 - (SplashCoord)size2.Int();
170	v = (SplashCoord)y + 0.5 - 0;	171	v = (SplashCoord)y + 0.5 - 0;
171	}	172	}
172	dist[(size2 + y) * size2 + x] = uu + vv;	173	dist[(size2.Int() + y) * size2.Int() + x] = uu + vv;
173	}	174	}
174	}	175	}
175		176
Lines 181-202 void SplashScreen::buildClusteredMatrix( Link Here
181	d = -1;	182	d = -1;
182	for (y = 0; y < size; ++y) {	183	for (y = 0; y < size; ++y) {
183	for (x = 0; x < size2; ++x) {	184	for (x = 0; x < size2; ++x) {
184	if (mat[y * size + x] == 0 &&	185	if (mat[y * size.Int() + x] == 0 &&
185	dist[y * size2 + x] > d) {	186	dist[y * size2.Int() + x] > d) {
186	x1 = x;	187	x1 = x;
187	y1 = y;	188	y1 = y;
188	d = dist[y1 * size2 + x1];	189	d = dist[y1 * size2.Int() + x1];
189	}	190	}
190	}	191	}
191	}	192	}
192	// map values in [0, 2sizesize2-1] --> [1, 255]	193	// map values in [0, 2sizesize2-1] --> [1, 255]
193	val = 1 + (254 * (2i)) / (2size*size2 - 1);	194	val = 1 + (254 * (2i)) / (2size.Int()*size2.Int() - 1);
194	mat[y1 * size + x1] = val;	195	mat[y1 * size.Int() + x1] = val;
195	val = 1 + (254 * (2i+1)) / (2size*size2 - 1);	196	val = 1 + (254 * (2i+1)) / (2size.Int()*size2.Int() - 1);
196	if (y1 < size2) {	197	if (y1 < size2.Int()) {
197	mat[(y1 + size2) * size + x1 + size2] = val;	198	mat[(y1 + size2.Int()) * size.Int() + x1 + size2.Int()] = val;
198	} else {	199	} else {
199	mat[(y1 - size2) * size + x1 + size2] = val;	200	mat[(y1 - size2.Int()) * size.Int() + x1 + size2.Int()] = val;
200	}	201	}
201	}	202	}
202		203
Lines 208-217 int SplashScreen::distance(int x0, int y Link Here
208	int dx0, dx1, dx, dy0, dy1, dy;	209	int dx0, dx1, dx, dy0, dy1, dy;
209		210
210	dx0 = abs(x0 - x1);	211	dx0 = abs(x0 - x1);
211	dx1 = size - dx0;	212	dx1 = size.Int() - dx0;
212	dx = dx0 < dx1 ? dx0 : dx1;	213	dx = dx0 < dx1 ? dx0 : dx1;
213	dy0 = abs(y0 - y1);	214	dy0 = abs(y0 - y1);
214	dy1 = size - dy0;	215	dy1 = size.Int() - dy0;
215	dy = dy0 < dy1 ? dy0 : dy1;	216	dy = dy0 < dy1 ? dy0 : dy1;
216	return dx * dx + dy * dy;	217	return dx * dx + dy * dy;
217	}	218	}
Lines 222-228 int SplashScreen::distance(int x0, int y Link Here
222	// Hardcopy, and Graphic Arts IV, SPIE Vol. 3648, pp. 496-505, 1999.	223	// Hardcopy, and Graphic Arts IV, SPIE Vol. 3648, pp. 496-505, 1999.
223	void SplashScreen::buildSCDMatrix(int r) {	224	void SplashScreen::buildSCDMatrix(int r) {
224	SplashScreenPoint dots, pts;	225	SplashScreenPoint dots, pts;
225	int dotsLen, dotsSize;	226	SafeInt dotsLen, dotsSize;
226	char *tmpl;	227	char *tmpl;
227	char *grid;	228	char *grid;
228	int region, dist;	229	int region, dist;
Lines 242-248 void SplashScreen::buildSCDMatrix(int r) Link Here
242	}	243	}
243	}	244	}
244	for (i = 0; i < size * size; ++i) {	245	for (i = 0; i < size * size; ++i) {
245	j = i + (int)((double)(size * size - i) *	246	j = i + (int)((double)(size.Int() * size.Int() - i) *
246	(double)rand() / ((double)RAND_MAX + 1.0));	247	(double)rand() / ((double)RAND_MAX + 1.0));
247	x = pts[i].x;	248	x = pts[i].x;
248	y = pts[i].y;	249	y = pts[i].y;
Lines 253-259 void SplashScreen::buildSCDMatrix(int r) Link Here
253	}	254	}
254		255
255	// construct the circle template	256	// construct the circle template
256	tmpl = (char )gmallocn((r+1)(r+1), sizeof(char));	257	tmpl = (char )gmallocn((SafeInt(r)+SafeInt(1))(SafeInt(r)+SafeInt(1)), sizeof(char));
257	for (y = 0; y <= r; ++y) {	258	for (y = 0; y <= r; ++y) {
258	for (x = 0; x <= r; ++x) {	259	for (x = 0; x <= r; ++x) {
259	tmpl[y(r+1) + x] = (x y <= r * r) ? 1 : 0;	260	tmpl[y(r+1) + x] = (x y <= r * r) ? 1 : 0;
Lines 264-270 void SplashScreen::buildSCDMatrix(int r) Link Here
264	grid = (char )gmallocn(size size, sizeof(char));	265	grid = (char )gmallocn(size size, sizeof(char));
265	for (y = 0; y < size; ++y) {	266	for (y = 0; y < size; ++y) {
266	for (x = 0; x < size; ++x) {	267	for (x = 0; x < size; ++x) {
267	grid[y*size + x] = 0;	268	grid[y*size.Int() + x] = 0;
268	}	269	}
269	}	270	}
270		271
Lines 272-298 void SplashScreen::buildSCDMatrix(int r) Link Here
272	dotsLen = 0;	273	dotsLen = 0;
273	dotsSize = 32;	274	dotsSize = 32;
274	dots = (SplashScreenPoint *)gmallocn(dotsSize, sizeof(SplashScreenPoint));	275	dots = (SplashScreenPoint *)gmallocn(dotsSize, sizeof(SplashScreenPoint));
275	for (i = 0; i < size * size; ++i) {	276	for (i = 0; i < size.Int() * size.Int(); ++i) {
276	x = pts[i].x;	277	x = pts[i].x;
277	y = pts[i].y;	278	y = pts[i].y;
278	if (!grid[y*size + x]) {	279	if (!grid[y*size.Int() + x]) {
279	if (dotsLen == dotsSize) {	280	if (dotsLen == dotsSize) {
280	dotsSize *= 2;	281	dotsSize *= 2;
281	dots = (SplashScreenPoint *)greallocn(dots, dotsSize,	282	dots = (SplashScreenPoint *)greallocn(dots, dotsSize,
282	sizeof(SplashScreenPoint));	283	sizeof(SplashScreenPoint));
283	}	284	}
284	dots[dotsLen++] = pts[i];	285	dots[(dotsLen++).Int()] = pts[i];
285	for (yy = 0; yy <= r; ++yy) {	286	for (yy = 0; yy <= r; ++yy) {
286	y0 = (y + yy) % size;	287	y0 = (y + yy) % size.Int();
287	y1 = (y - yy + size) % size;	288	y1 = (y - yy + size.Int()) % size.Int();
288	for (xx = 0; xx <= r; ++xx) {	289	for (xx = 0; xx <= r; ++xx) {
289	if (tmpl[yy*(r+1) + xx]) {	290	if (tmpl[yy*(r+1) + xx]) {
290	x0 = (x + xx) % size;	291	x0 = (x + xx) % size.Int();
291	x1 = (x - xx + size) % size;	292	x1 = (x - xx + size.Int()) % size.Int();
292	grid[y0*size + x0] = 1;	293	grid[y0*size.Int() + x0] = 1;
293	grid[y0*size + x1] = 1;	294	grid[y0*size.Int() + x1] = 1;
294	grid[y1*size + x0] = 1;	295	grid[y1*size.Int() + x0] = 1;
295	grid[y1*size + x1] = 1;	296	grid[y1*size.Int() + x1] = 1;
296	}	297	}
297	}	298	}
298	}	299	}
Lines 316-332 void SplashScreen::buildSCDMatrix(int r) Link Here
316	dMin = d;	317	dMin = d;
317	}	318	}
318	}	319	}
319	region[y*size + x] = iMin;	320	region[y*size.Int() + x] = iMin;
320	dist[y*size + x] = dMin;	321	dist[y*size.Int() + x] = dMin;
321	}	322	}
322	}	323	}
323		324
324	// compute threshold values	325	// compute threshold values
325	for (i = 0; i < dotsLen; ++i) {	326	for (i = 0; i < dotsLen; ++i) {
326	n = 0;	327	n = 0;
327	for (y = 0; y < size; ++y) {	328	for (y = 0; y < size.Int(); ++y) {
328	for (x = 0; x < size; ++x) {	329	for (x = 0; x < size.Int(); ++x) {
329	if (region[y*size + x] == i) {	330	if (region[y*size.Int() + x] == i) {
330	pts[n].x = x;	331	pts[n].x = x;
331	pts[n].y = y;	332	pts[n].y = y;
332	pts[n].dist = distance(dots[i].x, dots[i].y, x, y);	333	pts[n].dist = distance(dots[i].x, dots[i].y, x, y);
Lines 337-343 void SplashScreen::buildSCDMatrix(int r) Link Here
337	qsort(pts, n, sizeof(SplashScreenPoint), &cmpDistances);	338	qsort(pts, n, sizeof(SplashScreenPoint), &cmpDistances);
338	for (j = 0; j < n; ++j) {	339	for (j = 0; j < n; ++j) {
339	// map values in [0 .. n-1] --> [255 .. 1]	340	// map values in [0 .. n-1] --> [255 .. 1]
340	mat[pts[j].y * size + pts[j].x] = 255 - (254 * j) / (n - 1);	341	mat[pts[j].y * size.Int() + pts[j].x] = 255 - (254 * j) / (n - 1);
341	}	342	}
342	}	343	}
343		344
Lines 351-357 void SplashScreen::buildSCDMatrix(int r) Link Here
351	SplashScreen::SplashScreen(SplashScreen *screen) {	352	SplashScreen::SplashScreen(SplashScreen *screen) {
352	size = screen->size;	353	size = screen->size;
353	mat = (Guchar )gmallocn(size size, sizeof(Guchar));	354	mat = (Guchar )gmallocn(size size, sizeof(Guchar));
354	memcpy(mat, screen->mat, size * size * sizeof(Guchar));	355	memcpy(mat, screen->mat, (size * size).Int() * sizeof(Guchar));
355	minVal = screen->minVal;	356	minVal = screen->minVal;
356	maxVal = screen->maxVal;	357	maxVal = screen->maxVal;
357	}	358	}
Lines 369-381 int SplashScreen::test(int x, int y, Guc Link Here
369	if (value >= maxVal) {	370	if (value >= maxVal) {
370	return 1;	371	return 1;
371	}	372	}
372	if ((xx = x % size) < 0) {	373	if ((xx = x % size.Int()) < 0) {
373	xx = -xx;	374	xx = -xx;
374	}	375	}
375	if ((yy = y % size) < 0) {	376	if ((yy = y % size.Int()) < 0) {
376	yy = -yy;	377	yy = -yy;
377	}	378	}
378	return value < mat[yy * size + xx] ? 0 : 1;	379	return value < mat[yy * size.Int() + xx] ? 0 : 1;
379	}	380	}
380		381
381	GBool SplashScreen::isStatic(Guchar value) {	382	GBool SplashScreen::isStatic(Guchar value) {

Lines 74-80 CharCodeToUnicode *CharCodeToUnicode::pa Link Here

(-)poppler-0.12.0/poppler/CharCodeToUnicode.cc (-7 / +9 lines)
74	GooString *collection) {	74	GooString *collection) {
75	FILE *f;	75	FILE *f;
76	Unicode *mapA;	76	Unicode *mapA;
77	CharCode size, mapLenA;	77	CharCode mapLenA;
		78	SafeInt size;
78	char buf[64];	79	char buf[64];
79	Unicode u;	80	Unicode u;
80	CharCodeToUnicode *ctu;	81	CharCodeToUnicode *ctu;
Lines 116-122 CharCodeToUnicode *CharCodeToUnicode::pa Link Here
116	FILE *f;	117	FILE *f;
117	Unicode *mapA;	118	Unicode *mapA;
118	CharCodeToUnicodeString *sMapA;	119	CharCodeToUnicodeString *sMapA;
119	CharCode size, oldSize, len, sMapSizeA, sMapLenA;	120	CharCode len, sMapLenA;
		121	SafeInt size, oldSize, sMapSizeA;
120	char buf[256];	122	char buf[256];
121	char *tok;	123	char *tok;
122	Unicode u0;	124	Unicode u0;
Lines 134-140 CharCodeToUnicode *CharCodeToUnicode::pa Link Here
134		136
135	size = 4096;	137	size = 4096;
136	mapA = (Unicode *)gmallocn(size, sizeof(Unicode));	138	mapA = (Unicode *)gmallocn(size, sizeof(Unicode));
137	memset(mapA, 0, size * sizeof(Unicode));	139	memset(mapA, 0, size.Int() * sizeof(Unicode));
138	len = 0;	140	len = 0;
139	sMapA = NULL;	141	sMapA = NULL;
140	sMapSizeA = sMapLenA = 0;	142	sMapSizeA = sMapLenA = 0;
Lines 173-179 CharCodeToUnicode *CharCodeToUnicode::pa Link Here
173	size *= 2;	175	size *= 2;
174	}	176	}
175	mapA = (Unicode *)greallocn(mapA, size, sizeof(Unicode));	177	mapA = (Unicode *)greallocn(mapA, size, sizeof(Unicode));
176	memset(mapA + oldSize, 0, (size - oldSize) * sizeof(Unicode));	178	memset(mapA + oldSize.Int(), 0, (size - oldSize).Int() * sizeof(Unicode));
177	}	179	}
178	if (n == 1) {	180	if (n == 1) {
179	mapA[u0] = uBuf[0];	181	mapA[u0] = uBuf[0];
Lines 199-205 CharCodeToUnicode *CharCodeToUnicode::pa Link Here
199	fclose(f);	201	fclose(f);
200		202
201	ctu = new CharCodeToUnicode(fileName->copy(), mapA, len, gTrue,	203	ctu = new CharCodeToUnicode(fileName->copy(), mapA, len, gTrue,
202	sMapA, sMapLenA, sMapSizeA);	204	sMapA, sMapLenA, sMapSizeA.Int());
203	gfree(mapA);	205	gfree(mapA);
204	gfree(uBuf);	206	gfree(uBuf);
205	return ctu;	207	return ctu;
Lines 360-366 void CharCodeToUnicode::addMapping(CharC Link Here
360		362
361	if (code >= mapLen) {	363	if (code >= mapLen) {
362	oldLen = mapLen;	364	oldLen = mapLen;
363	mapLen = (code + 256) & ~255;	365	mapLen = (SafeInt(code) + 256).Int() & ~255;
364	map = (Unicode *)greallocn(map, mapLen, sizeof(Unicode));	366	map = (Unicode *)greallocn(map, mapLen, sizeof(Unicode));
365	for (i = oldLen; i < mapLen; ++i) {	367	for (i = oldLen; i < mapLen; ++i) {
366	map[i] = 0;	368	map[i] = 0;
Lines 404-410 CharCodeToUnicode::CharCodeToUnicode(Goo Link Here
404	map[i] = 0;	406	map[i] = 0;
405	}	407	}
406	sMap = NULL;	408	sMap = NULL;
407	sMapLen = sMapSize = 0;	409	sMapSize = sMapLen = 0;
408	refCnt = 1;	410	refCnt = 1;
409	#if MULTITHREADED	411	#if MULTITHREADED
410	gInitMutex(&mutex);	412	gInitMutex(&mutex);

Lines 144-150 private: Link Here

(-)poppler-0.12.0/poppler/Function.h (-4 / +4 lines)
144	inputMul[funcMaxInputs];	144	inputMul[funcMaxInputs];
145	int idxMul[funcMaxInputs]; // sample array index multipliers	145	int idxMul[funcMaxInputs]; // sample array index multipliers
146	double *samples; // the samples	146	double *samples; // the samples
147	int nSamples; // size of the samples array	147	SafeInt nSamples; // size of the samples array
148	double *sBuf; // buffer for the transform function	148	double *sBuf; // buffer for the transform function
149	GBool ok;	149	GBool ok;
150	};	150	};
Lines 191-197 public: Link Here
191	virtual void transform(double in, double out);	191	virtual void transform(double in, double out);
192	virtual GBool isOk() { return ok; }	192	virtual GBool isOk() { return ok; }
193		193
194	int getNumFuncs() { return k; }	194	int getNumFuncs() { return k.Int(); }
195	Function *getFunc(int i) { return funcs[i]; }	195	Function *getFunc(int i) { return funcs[i]; }
196	double *getBounds() { return bounds; }	196	double *getBounds() { return bounds; }
197	double *getEncode() { return encode; }	197	double *getEncode() { return encode; }
Lines 201-207 private: Link Here
201		201
202	StitchingFunction(StitchingFunction *func);	202	StitchingFunction(StitchingFunction *func);
203		203
204	int k;	204	SafeInt k;
205	Function **funcs;	205	Function **funcs;
206	double *bounds;	206	double *bounds;
207	double *encode;	207	double *encode;
Lines 236-242 private: Link Here
236	GooString *codeString;	236	GooString *codeString;
237	PSObject *code;	237	PSObject *code;
238	PSStack *stack;	238	PSStack *stack;
239	int codeSize;	239	SafeInt codeSize;
240	GBool ok;	240	GBool ok;
241	PopplerCache *cache;	241	PopplerCache *cache;
242	};	242	};

Lines 480-486 char GfxFont::readEmbFontFile(XRef xre Link Here

(-)poppler-0.12.0/poppler/GfxFont.cc (-15 / +17 lines)
480	Object obj1, obj2;	480	Object obj1, obj2;
481	Stream *str;	481	Stream *str;
482	int c;	482	int c;
483	int size, i;	483	SafeInt size;
		484	int i;
484		485
485	obj1.initRef(embFontID.num, embFontID.gen);	486	obj1.initRef(embFontID.num, embFontID.gen);
486	obj1.fetch(xref, &obj2);	487	obj1.fetch(xref, &obj2);
Lines 494-505 char GfxFont::readEmbFontFile(XRef xre Link Here
494	str = obj2.getStream();	495	str = obj2.getStream();
495		496
496	buf = NULL;	497	buf = NULL;
497	i = size = 0;	498	size = i = 0;
498	str->reset();	499	str->reset();
499	while ((c = str->getChar()) != EOF) {	500	while ((c = str->getChar()) != EOF) {
500	if (i == size) {	501	if (i == size) {
501	size += 4096;	502	size += 4096;
502	buf = (char *)grealloc(buf, size);	503	buf = (char *)grealloc(buf, size.Int());
503	}	504	}
504	buf[i++] = c;	505	buf[i++] = c;
505	}	506	}
Lines 1327-1333 GfxCIDFont::GfxCIDFont(XRef *xref, char Link Here
1327	CharCode c;	1328	CharCode c;
1328	Unicode *uBuf;	1329	Unicode *uBuf;
1329	int c1, c2;	1330	int c1, c2;
1330	int excepsSize, i, j, k, n;	1331	int j, k, n;
		1332	SafeInt i, excepsSize;
1331		1333
1332	refCnt = 1;	1334	refCnt = 1;
1333	ascent = 0.95;	1335	ascent = 0.95;
Lines 1523-1532 GfxCIDFont::GfxCIDFont(XRef *xref, char Link Here
1523	excepsSize = 0;	1525	excepsSize = 0;
1524	i = 0;	1526	i = 0;
1525	while (i + 1 < obj1.arrayGetLength()) {	1527	while (i + 1 < obj1.arrayGetLength()) {
1526	obj1.arrayGet(i, &obj2);	1528	obj1.arrayGet(i.Int(), &obj2);
1527	obj1.arrayGet(i + 1, &obj3);	1529	obj1.arrayGet((i + 1).Int(), &obj3);
1528	if (obj2.isInt() && obj3.isInt() && i + 2 < obj1.arrayGetLength()) {	1530	if (obj2.isInt() && obj3.isInt() && (i + 2).Int() < obj1.arrayGetLength()) {
1529	if (obj1.arrayGet(i + 2, &obj4)->isNum()) {	1531	if (obj1.arrayGet((i + 2).Int(), &obj4)->isNum()) {
1530	if (widths.nExceps == excepsSize) {	1532	if (widths.nExceps == excepsSize) {
1531	excepsSize += 16;	1533	excepsSize += 16;
1532	widths.exceps = (GfxFontCIDWidthExcep *)	1534	widths.exceps = (GfxFontCIDWidthExcep *)
Lines 1544-1550 GfxCIDFont::GfxCIDFont(XRef *xref, char Link Here
1544	i += 3;	1546	i += 3;
1545	} else if (obj2.isInt() && obj3.isArray()) {	1547	} else if (obj2.isInt() && obj3.isArray()) {
1546	if (widths.nExceps + obj3.arrayGetLength() > excepsSize) {	1548	if (widths.nExceps + obj3.arrayGetLength() > excepsSize) {
1547	excepsSize = (widths.nExceps + obj3.arrayGetLength() + 15) & ~15;	1549	excepsSize = (SafeInt(widths.nExceps) + SafeInt(obj3.arrayGetLength()) + 15).Int() & ~15;
1548	widths.exceps = (GfxFontCIDWidthExcep *)	1550	widths.exceps = (GfxFontCIDWidthExcep *)
1549	greallocn(widths.exceps,	1551	greallocn(widths.exceps,
1550	excepsSize, sizeof(GfxFontCIDWidthExcep));	1552	excepsSize, sizeof(GfxFontCIDWidthExcep));
Lines 1594-1605 GfxCIDFont::GfxCIDFont(XRef *xref, char Link Here
1594	excepsSize = 0;	1596	excepsSize = 0;
1595	i = 0;	1597	i = 0;
1596	while (i + 1 < obj1.arrayGetLength()) {	1598	while (i + 1 < obj1.arrayGetLength()) {
1597	obj1.arrayGet(i, &obj2);	1599	obj1.arrayGet(i.Int(), &obj2);
1598	obj1.arrayGet(i+ 1, &obj3);	1600	obj1.arrayGet((i+ 1).Int(), &obj3);
1599	if (obj2.isInt() && obj3.isInt() && i + 4 < obj1.arrayGetLength()) {	1601	if (obj2.isInt() && obj3.isInt() && (i + 4).Int() < obj1.arrayGetLength()) {
1600	if (obj1.arrayGet(i + 2, &obj4)->isNum() &&	1602	if (obj1.arrayGet((i + 2).Int(), &obj4)->isNum() &&
1601	obj1.arrayGet(i + 3, &obj5)->isNum() &&	1603	obj1.arrayGet((i + 3).Int(), &obj5)->isNum() &&
1602	obj1.arrayGet(i + 4, &obj6)->isNum()) {	1604	obj1.arrayGet((i + 4).Int(), &obj6)->isNum()) {
1603	if (widths.nExcepsV == excepsSize) {	1605	if (widths.nExcepsV == excepsSize) {
1604	excepsSize += 16;	1606	excepsSize += 16;
1605	widths.excepsV = (GfxFontCIDWidthExcepV *)	1607	widths.excepsV = (GfxFontCIDWidthExcepV *)

Lines 1027-1033 private: Link Here

(-)poppler-0.12.0/poppler/GfxState.h (-7 / +7 lines)
1027	GBool *curve; // curve[i] => point i is a control point	1027	GBool *curve; // curve[i] => point i is a control point
1028	// for a Bezier curve	1028	// for a Bezier curve
1029	int n; // number of points	1029	int n; // number of points
1030	int size; // size of x/y arrays	1030	SafeInt size; // size of x/y arrays
1031	GBool closed; // set if path is closed	1031	GBool closed; // set if path is closed
1032		1032
1033	GfxSubpath(GfxSubpath *subpath);	1033	GfxSubpath(GfxSubpath *subpath);
Lines 1053-1064 public: Link Here
1053	GBool isPath() { return n > 0; }	1053	GBool isPath() { return n > 0; }
1054		1054
1055	// Get subpaths.	1055	// Get subpaths.
1056	int getNumSubpaths() { return n; }	1056	int getNumSubpaths() { return n.Int(); }
1057	GfxSubpath *getSubpath(int i) { return subpaths[i]; }	1057	GfxSubpath *getSubpath(int i) { return subpaths[i]; }
1058		1058
1059	// Get last point on last subpath.	1059	// Get last point on last subpath.
1060	double getLastX() { return subpaths[n-1]->getLastX(); }	1060	double getLastX() { return subpaths[n.Int()-1]->getLastX(); }
1061	double getLastY() { return subpaths[n-1]->getLastY(); }	1061	double getLastY() { return subpaths[n.Int()-1]->getLastY(); }
1062		1062
1063	// Move the current point.	1063	// Move the current point.
1064	void moveTo(double x, double y);	1064	void moveTo(double x, double y);
Lines 1084-1094 private: Link Here
1084	GBool justMoved; // set if a new subpath was just started	1084	GBool justMoved; // set if a new subpath was just started
1085	double firstX, firstY; // first point in new subpath	1085	double firstX, firstY; // first point in new subpath
1086	GfxSubpath **subpaths; // subpaths	1086	GfxSubpath **subpaths; // subpaths
1087	int n; // number of subpaths	1087	SafeInt n; // number of subpaths
1088	int size; // size of subpaths array	1088	SafeInt size; // size of subpaths array
1089		1089
1090	GfxPath(GBool justMoved1, double firstX1, double firstY1,	1090	GfxPath(GBool justMoved1, double firstX1, double firstY1,
1091	GfxSubpath **subpaths1, int n1, int size1);	1091	GfxSubpath **subpaths1, SafeInt n1, SafeInt size1);
1092	};	1092	};
1093		1093
1094	//------------------------------------------------------------------------	1094	//------------------------------------------------------------------------

Lines 1695-1701 GfxIndexedColorSpace::GfxIndexedColorSpa Link Here

(-)poppler-0.12.0/poppler/GfxState.cc (-29 / +33 lines)
1695	int indexHighA) {	1695	int indexHighA) {
1696	base = baseA;	1696	base = baseA;
1697	indexHigh = indexHighA;	1697	indexHigh = indexHighA;
1698	lookup = (Guchar )gmallocn((indexHigh + 1) base->getNComps(),	1698	lookup = (Guchar )gmallocn((SafeInt(indexHigh) + SafeInt(1)) SafeInt(base->getNComps()),
1699	sizeof(Guchar));	1699	sizeof(Guchar));
1700	}	1700	}
1701		1701
Lines 3123-3129 GfxGouraudTriangleShading::GfxGouraudTri Link Here
3123	vertices = (GfxGouraudVertex *)gmallocn(nVertices, sizeof(GfxGouraudVertex));	3123	vertices = (GfxGouraudVertex *)gmallocn(nVertices, sizeof(GfxGouraudVertex));
3124	memcpy(vertices, shading->vertices, nVertices * sizeof(GfxGouraudVertex));	3124	memcpy(vertices, shading->vertices, nVertices * sizeof(GfxGouraudVertex));
3125	nTriangles = shading->nTriangles;	3125	nTriangles = shading->nTriangles;
3126	triangles = (int ()[3])gmallocn(nTriangles 3, sizeof(int));	3126	triangles = (int ()[3])gmallocn(SafeInt(nTriangles) SafeInt(3), sizeof(int));
3127	memcpy(triangles, shading->triangles, nTriangles * 3 * sizeof(int));	3127	memcpy(triangles, shading->triangles, nTriangles * 3 * sizeof(int));
3128	nFuncs = shading->nFuncs;	3128	nFuncs = shading->nFuncs;
3129	for (i = 0; i < nFuncs; ++i) {	3129	for (i = 0; i < nFuncs; ++i) {
Lines 3154-3160 GfxGouraudTriangleShading *GfxGouraudTri Link Here
3154	double cMul[gfxColorMaxComps];	3154	double cMul[gfxColorMaxComps];
3155	GfxGouraudVertex *verticesA;	3155	GfxGouraudVertex *verticesA;
3156	int (*trianglesA)[3];	3156	int (*trianglesA)[3];
3157	int nComps, nVerticesA, nTrianglesA, vertSize, triSize;	3157	int nComps, nVerticesA, nTrianglesA;
		3158	SafeInt vertSize, triSize;
3158	Guint x, y, flag;	3159	Guint x, y, flag;
3159	Guint c[gfxColorMaxComps];	3160	Guint c[gfxColorMaxComps];
3160	GfxShadingBitBuf *bitBuf;	3161	GfxShadingBitBuf *bitBuf;
Lines 3273-3283 GfxGouraudTriangleShading *GfxGouraudTri Link Here
3273	break;	3274	break;
3274	}	3275	}
3275	if (nVerticesA == vertSize) {	3276	if (nVerticesA == vertSize) {
3276	int oldVertSize = vertSize;	3277	SafeInt oldVertSize = vertSize;
3277	vertSize = (vertSize == 0) ? 16 : 2 * vertSize;	3278	vertSize = (vertSize == 0) ? 16 : 2 * vertSize;
3278	verticesA = (GfxGouraudVertex *)	3279	verticesA = (GfxGouraudVertex *)
3279	greallocn(verticesA, vertSize, sizeof(GfxGouraudVertex));	3280	greallocn(verticesA, vertSize, sizeof(GfxGouraudVertex));
3280	memset(verticesA + oldVertSize, 0, (vertSize - oldVertSize) * sizeof(GfxGouraudVertex));	3281	memset(verticesA + oldVertSize.Int(), 0, (vertSize - oldVertSize).Int() * sizeof(GfxGouraudVertex));
3281	}	3282	}
3282	verticesA[nVerticesA].x = xMin + xMul * (double)x;	3283	verticesA[nVerticesA].x = xMin + xMul * (double)x;
3283	verticesA[nVerticesA].y = yMin + yMul * (double)y;	3284	verticesA[nVerticesA].y = yMin + yMul * (double)y;
Lines 3294-3300 GfxGouraudTriangleShading *GfxGouraudTri Link Here
3294	if (nTrianglesA == triSize) {	3295	if (nTrianglesA == triSize) {
3295	triSize = (triSize == 0) ? 16 : 2 * triSize;	3296	triSize = (triSize == 0) ? 16 : 2 * triSize;
3296	trianglesA = (int (*)[3])	3297	trianglesA = (int (*)[3])
3297	greallocn(trianglesA, triSize * 3, sizeof(int));	3298	greallocn(trianglesA, SafeInt(triSize) * SafeInt(3), sizeof(int));
3298	}	3299	}
3299	if (state == 2) {	3300	if (state == 2) {
3300	trianglesA[nTrianglesA][0] = nVerticesA - 3;	3301	trianglesA[nTrianglesA][0] = nVerticesA - 3;
Lines 3319-3326 GfxGouraudTriangleShading *GfxGouraudTri Link Here
3319	delete bitBuf;	3320	delete bitBuf;
3320	if (typeA == 5) {	3321	if (typeA == 5) {
3321	nRows = nVerticesA / vertsPerRow;	3322	nRows = nVerticesA / vertsPerRow;
3322	nTrianglesA = (nRows - 1) * 2 * (vertsPerRow - 1);	3323	nTrianglesA = ((SafeInt(nRows) - SafeInt(1)) * SafeInt(2)
3323	trianglesA = (int ()[3])gmallocn(nTrianglesA 3, sizeof(int));	3324	* (SafeInt(vertsPerRow) - SafeInt(1))).Int();
		3325	trianglesA = (int ()[3])gmallocn(SafeInt(nTrianglesA) SafeInt(3), sizeof(int));
3324	k = 0;	3326	k = 0;
3325	for (i = 0; i < nRows - 1; ++i) {	3327	for (i = 0; i < nRows - 1; ++i) {
3326	for (j = 0; j < vertsPerRow - 1; ++j) {	3328	for (j = 0; j < vertsPerRow - 1; ++j) {
Lines 3461-3467 GfxPatchMeshShading *GfxPatchMeshShading Link Here
3461	double xMul, yMul;	3463	double xMul, yMul;
3462	double cMul[gfxColorMaxComps];	3464	double cMul[gfxColorMaxComps];
3463	GfxPatch patchesA, p;	3465	GfxPatch patchesA, p;
3464	int nComps, nPatchesA, patchesSize, nPts, nColors;	3466	int nComps, nPatchesA, nPts, nColors;
		3467	SafeInt patchesSize;
3465	Guint flag;	3468	Guint flag;
3466	double x[16], y[16];	3469	double x[16], y[16];
3467	Guint xi, yi;	3470	Guint xi, yi;
Lines 3597-3607 GfxPatchMeshShading *GfxPatchMeshShading Link Here
3597	break;	3600	break;
3598	}	3601	}
3599	if (nPatchesA == patchesSize) {	3602	if (nPatchesA == patchesSize) {
3600	int oldPatchesSize = patchesSize;	3603	SafeInt oldPatchesSize = patchesSize;
3601	patchesSize = (patchesSize == 0) ? 16 : 2 * patchesSize;	3604	patchesSize = (patchesSize == 0) ? 16 : 2 * patchesSize;
3602	patchesA = (GfxPatch *)greallocn(patchesA,	3605	patchesA = (GfxPatch *)greallocn(patchesA,
3603	patchesSize, sizeof(GfxPatch));	3606	patchesSize, sizeof(GfxPatch));
3604	memset(patchesA + oldPatchesSize, 0, (patchesSize - oldPatchesSize) * sizeof(GfxPatch));	3607	memset(patchesA + oldPatchesSize.Int(), 0, (patchesSize - oldPatchesSize).Int() * sizeof(GfxPatch));
3605	}	3608	}
3606	p = &patchesA[nPatchesA];	3609	p = &patchesA[nPatchesA];
3607	if (typeA == 6) {	3610	if (typeA == 6) {
Lines 4058-4064 GfxImageColorMap::GfxImageColorMap(int b Link Here
4058	useByteLookup = gTrue;	4061	useByteLookup = gTrue;
4059	}	4062	}
4060	for (k = 0; k < nComps2; ++k) {	4063	for (k = 0; k < nComps2; ++k) {
4061	lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1,	4064	lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1),
4062	sizeof(GfxColorComp));	4065	sizeof(GfxColorComp));
4063	for (i = 0; i <= maxPixel; ++i) {	4066	for (i = 0; i <= maxPixel; ++i) {
4064	j = (int)(decodeLow[0] + (i * decodeRange[0]) / maxPixel + 0.5);	4067	j = (int)(decodeLow[0] + (i * decodeRange[0]) / maxPixel + 0.5);
Lines 4081-4091 GfxImageColorMap::GfxImageColorMap(int b Link Here
4081	nComps2 = colorSpace2->getNComps();	4084	nComps2 = colorSpace2->getNComps();
4082	sepFunc = sepCS->getFunc();	4085	sepFunc = sepCS->getFunc();
4083	if (colorSpace2->useGetGrayLine() \|\| colorSpace2->useGetRGBLine()) {	4086	if (colorSpace2->useGetGrayLine() \|\| colorSpace2->useGetRGBLine()) {
4084	byte_lookup = (Guchar *)gmallocn ((maxPixel + 1), nComps2);	4087	byte_lookup = (Guchar *)gmallocn ((SafeInt(maxPixel) + SafeInt(1)), nComps2);
4085	useByteLookup = gTrue;	4088	useByteLookup = gTrue;
4086	}	4089	}
4087	for (k = 0; k < nComps2; ++k) {	4090	for (k = 0; k < nComps2; ++k) {
4088	lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1,	4091	lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1),
4089	sizeof(GfxColorComp));	4092	sizeof(GfxColorComp));
4090	for (i = 0; i <= maxPixel; ++i) {	4093	for (i = 0; i <= maxPixel; ++i) {
4091	x[0] = decodeLow[0] + (i * decodeRange[0]) / maxPixel;	4094	x[0] = decodeLow[0] + (i * decodeRange[0]) / maxPixel;
Lines 4098-4108 GfxImageColorMap::GfxImageColorMap(int b Link Here
4098	break;	4101	break;
4099	default:	4102	default:
4100	if (colorSpace->useGetGrayLine() \|\| colorSpace->useGetRGBLine()) {	4103	if (colorSpace->useGetGrayLine() \|\| colorSpace->useGetRGBLine()) {
4101	byte_lookup = (Guchar *)gmallocn ((maxPixel + 1), nComps);	4104	byte_lookup = (Guchar *)gmallocn ((SafeInt(maxPixel) + SafeInt(1)), nComps);
4102	useByteLookup = gTrue;	4105	useByteLookup = gTrue;
4103	}	4106	}
4104	for (k = 0; k < nComps; ++k) {	4107	for (k = 0; k < nComps; ++k) {
4105	lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1,	4108	lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1),
4106	sizeof(GfxColorComp));	4109	sizeof(GfxColorComp));
4107	for (i = 0; i <= maxPixel; ++i) {	4110	for (i = 0; i <= maxPixel; ++i) {
4108	mapped = decodeLow[k] + (i * decodeRange[k]) / maxPixel;	4111	mapped = decodeLow[k] + (i * decodeRange[k]) / maxPixel;
Lines 4130-4136 GfxImageColorMap::GfxImageColorMap(int b Link Here
4130	}	4133	}
4131		4134
4132	GfxImageColorMap::GfxImageColorMap(GfxImageColorMap *colorMap) {	4135	GfxImageColorMap::GfxImageColorMap(GfxImageColorMap *colorMap) {
4133	int n, i, k;	4136	int i, k;
		4137	SafeInt n;
4134		4138
4135	colorSpace = colorMap->colorSpace->copy();	4139	colorSpace = colorMap->colorSpace->copy();
4136	bits = colorMap->bits;	4140	bits = colorMap->bits;
Lines 4145-4169 GfxImageColorMap::GfxImageColorMap(GfxIm Link Here
4145	colorSpace2 = ((GfxIndexedColorSpace *)colorSpace)->getBase();	4149	colorSpace2 = ((GfxIndexedColorSpace *)colorSpace)->getBase();
4146	for (k = 0; k < nComps2; ++k) {	4150	for (k = 0; k < nComps2; ++k) {
4147	lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));	4151	lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));
4148	memcpy(lookup[k], colorMap->lookup[k], n * sizeof(GfxColorComp));	4152	memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp));
4149	}	4153	}
4150	} else if (colorSpace->getMode() == csSeparation) {	4154	} else if (colorSpace->getMode() == csSeparation) {
4151	colorSpace2 = ((GfxSeparationColorSpace *)colorSpace)->getAlt();	4155	colorSpace2 = ((GfxSeparationColorSpace *)colorSpace)->getAlt();
4152	for (k = 0; k < nComps2; ++k) {	4156	for (k = 0; k < nComps2; ++k) {
4153	lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));	4157	lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));
4154	memcpy(lookup[k], colorMap->lookup[k], n * sizeof(GfxColorComp));	4158	memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp));
4155	}	4159	}
4156	} else {	4160	} else {
4157	for (k = 0; k < nComps; ++k) {	4161	for (k = 0; k < nComps; ++k) {
4158	lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));	4162	lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp));
4159	memcpy(lookup[k], colorMap->lookup[k], n * sizeof(GfxColorComp));	4163	memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp));
4160	}	4164	}
4161	}	4165	}
4162	if (colorMap->byte_lookup) {	4166	if (colorMap->byte_lookup) {
4163	int nc = colorSpace2 ? nComps2 : nComps;	4167	int nc = colorSpace2 ? nComps2 : nComps;
4164		4168
4165	byte_lookup = (Guchar *)gmallocn (n, nc);	4169	byte_lookup = (Guchar *)gmallocn (n, nc);
4166	memcpy(byte_lookup, colorMap->byte_lookup, n * nc);	4170	memcpy(byte_lookup, colorMap->byte_lookup, n.Int() * nc);
4167	}	4171	}
4168	for (i = 0; i < nComps; ++i) {	4172	for (i = 0; i < nComps; ++i) {
4169	decodeLow[i] = colorMap->decodeLow[i];	4173	decodeLow[i] = colorMap->decodeLow[i];
Lines 4432-4438 GfxPath::~GfxPath() { Link Here
4432		4436
4433	// Used for copy().	4437	// Used for copy().
4434	GfxPath::GfxPath(GBool justMoved1, double firstX1, double firstY1,	4438	GfxPath::GfxPath(GBool justMoved1, double firstX1, double firstY1,
4435	GfxSubpath **subpaths1, int n1, int size1) {	4439	GfxSubpath **subpaths1, SafeInt n1, SafeInt size1) {
4436	int i;	4440	int i;
4437		4441
4438	justMoved = justMoved1;	4442	justMoved = justMoved1;
Lines 4458-4468 void GfxPath::lineTo(double x, double y) Link Here
4458	subpaths = (GfxSubpath **)	4462	subpaths = (GfxSubpath **)
4459	greallocn(subpaths, size, sizeof(GfxSubpath *));	4463	greallocn(subpaths, size, sizeof(GfxSubpath *));
4460	}	4464	}
4461	subpaths[n] = new GfxSubpath(firstX, firstY);	4465	subpaths[n.Int()] = new GfxSubpath(firstX, firstY);
4462	++n;	4466	++n;
4463	justMoved = gFalse;	4467	justMoved = gFalse;
4464	}	4468	}
4465	subpaths[n-1]->lineTo(x, y);	4469	subpaths[n.Int()-1]->lineTo(x, y);
4466	}	4470	}
4467		4471
4468	void GfxPath::curveTo(double x1, double y1, double x2, double y2,	4472	void GfxPath::curveTo(double x1, double y1, double x2, double y2,
Lines 4473-4483 void GfxPath::curveTo(double x1, double Link Here
4473	subpaths = (GfxSubpath **)	4477	subpaths = (GfxSubpath **)
4474	greallocn(subpaths, size, sizeof(GfxSubpath *));	4478	greallocn(subpaths, size, sizeof(GfxSubpath *));
4475	}	4479	}
4476	subpaths[n] = new GfxSubpath(firstX, firstY);	4480	subpaths[n.Int()] = new GfxSubpath(firstX, firstY);
4477	++n;	4481	++n;
4478	justMoved = gFalse;	4482	justMoved = gFalse;
4479	}	4483	}
4480	subpaths[n-1]->curveTo(x1, y1, x2, y2, x3, y3);	4484	subpaths[n.Int()-1]->curveTo(x1, y1, x2, y2, x3, y3);
4481	}	4485	}
4482		4486
4483	void GfxPath::close() {	4487	void GfxPath::close() {
Lines 4489-4499 void GfxPath::close() { Link Here
4489	subpaths = (GfxSubpath **)	4493	subpaths = (GfxSubpath **)
4490	greallocn(subpaths, size, sizeof(GfxSubpath *));	4494	greallocn(subpaths, size, sizeof(GfxSubpath *));
4491	}	4495	}
4492	subpaths[n] = new GfxSubpath(firstX, firstY);	4496	subpaths[n.Int()] = new GfxSubpath(firstX, firstY);
4493	++n;	4497	++n;
4494	justMoved = gFalse;	4498	justMoved = gFalse;
4495	}	4499	}
4496	subpaths[n-1]->close();	4500	subpaths[n.Int()-1]->close();
4497	}	4501	}
4498		4502
4499	void GfxPath::append(GfxPath *path) {	4503	void GfxPath::append(GfxPath *path) {
Lines 4505-4511 void GfxPath::append(GfxPath *path) { Link Here
4505	greallocn(subpaths, size, sizeof(GfxSubpath *));	4509	greallocn(subpaths, size, sizeof(GfxSubpath *));
4506	}	4510	}
4507	for (i = 0; i < path->n; ++i) {	4511	for (i = 0; i < path->n; ++i) {
4508	subpaths[n++] = path->subpaths[i]->copy();	4512	subpaths[(n++).Int()] = path->subpaths[i]->copy();
4509	}	4513	}
4510	justMoved = gFalse;	4514	justMoved = gFalse;
4511	}	4515	}

Lines 702-708 JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, Link Here

(-)poppler-0.12.0/poppler/JBIG2Stream.cc (-9 / +11 lines)
702	{	702	{
703	w = wA;	703	w = wA;
704	h = hA;	704	h = hA;
705	line = (wA + 7) >> 3;	705	line = (SafeInt(wA) + SafeInt(7) >> 3).Int();
706		706
707	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {	707	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {
708	error(-1, "invalid width/height");	708	error(-1, "invalid width/height");
Lines 1599-1605 GBool JBIG2Stream::readSymbolDictSeg(Gui Link Here
1599	}	1599	}
1600		1600
1601	// get the input symbol bitmaps	1601	// get the input symbol bitmaps
1602	bitmaps = (JBIG2Bitmap **)gmallocn(numInputSyms + numNewSyms,	1602	bitmaps = (JBIG2Bitmap **)gmallocn(SafeInt(numInputSyms) + SafeInt(numNewSyms),
1603	sizeof(JBIG2Bitmap *));	1603	sizeof(JBIG2Bitmap *));
1604	for (i = 0; i < numInputSyms + numNewSyms; ++i) {	1604	for (i = 0; i < numInputSyms + numNewSyms; ++i) {
1605	bitmaps[i] = NULL;	1605	bitmaps[i] = NULL;
Lines 1927-1933 void JBIG2Stream::readTextRegionSeg(Guin Link Here
1927	int sOffset;	1927	int sOffset;
1928	Guint huffFlags, huffFS, huffDS, huffDT;	1928	Guint huffFlags, huffFS, huffDS, huffDT;
1929	Guint huffRDW, huffRDH, huffRDX, huffRDY, huffRSize;	1929	Guint huffRDW, huffRDH, huffRDX, huffRDY, huffRSize;
1930	Guint numInstances, numSyms, symCodeLen;	1930	Guint numInstances, symCodeLen;
		1931	SafeInt numSyms;
1931	int atx[2], aty[2];	1932	int atx[2], aty[2];
1932	Guint i, k, kk;	1933	Guint i, k, kk;
1933	int j;	1934	int j;
Lines 2130-2136 void JBIG2Stream::readTextRegionSeg(Guin Link Here
2130	runLengthTab[35].prefixLen = 0;	2131	runLengthTab[35].prefixLen = 0;
2131	runLengthTab[35].rangeLen = jbig2HuffmanEOT;	2132	runLengthTab[35].rangeLen = jbig2HuffmanEOT;
2132	huffDecoder->buildTable(runLengthTab, 35);	2133	huffDecoder->buildTable(runLengthTab, 35);
2133	symCodeTab = (JBIG2HuffmanTable *)gmallocn(numSyms + 1,	2134	symCodeTab = (JBIG2HuffmanTable *)gmallocn(numSyms + SafeInt(1),
2134	sizeof(JBIG2HuffmanTable));	2135	sizeof(JBIG2HuffmanTable));
2135	for (i = 0; i < numSyms; ++i) {	2136	for (i = 0; i < numSyms; ++i) {
2136	symCodeTab[i].val = i;	2137	symCodeTab[i].val = i;
Lines 2152-2160 void JBIG2Stream::readTextRegionSeg(Guin Link Here
2152	symCodeTab[i++].prefixLen = j;	2153	symCodeTab[i++].prefixLen = j;
2153	}	2154	}
2154	}	2155	}
2155	symCodeTab[numSyms].prefixLen = 0;	2156	symCodeTab[numSyms.Int()].prefixLen = 0;
2156	symCodeTab[numSyms].rangeLen = jbig2HuffmanEOT;	2157	symCodeTab[numSyms.Int()].rangeLen = jbig2HuffmanEOT;
2157	huffDecoder->buildTable(symCodeTab, numSyms);	2158	huffDecoder->buildTable(symCodeTab, numSyms.Int());
2158	huffDecoder->reset();	2159	huffDecoder->reset();
2159		2160
2160	// set up the arithmetic decoder	2161	// set up the arithmetic decoder
Lines 2168-2174 void JBIG2Stream::readTextRegionSeg(Guin Link Here
2168	}	2169	}
2169		2170
2170	bitmap = readTextRegion(huff, refine, w, h, numInstances,	2171	bitmap = readTextRegion(huff, refine, w, h, numInstances,
2171	logStrips, numSyms, symCodeTab, symCodeLen, syms,	2172	logStrips, numSyms.Int(), symCodeTab, symCodeLen, syms,
2172	defPixel, combOp, transposed, refCorner, sOffset,	2173	defPixel, combOp, transposed, refCorner, sOffset,
2173	huffFSTable, huffDSTable, huffDTTable,	2174	huffFSTable, huffDSTable, huffDTTable,
2174	huffRDWTable, huffRDHTable,	2175	huffRDWTable, huffRDHTable,
Lines 2781-2786 JBIG2Bitmap *JBIG2Stream::readGenericBit Link Here
2781	error(curStr->getPos(), "Bad width in JBIG2 generic bitmap");	2782	error(curStr->getPos(), "Bad width in JBIG2 generic bitmap");
2782	// force a call to gmalloc(-1), which will throw an exception	2783	// force a call to gmalloc(-1), which will throw an exception
2783	w = -3;	2784	w = -3;
		2785	gmallocn(w + 2, sizeof(int));
2784	}	2786	}
2785	// 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = w	2787	// 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = w
2786	// ---> max codingLine size = w + 1	2788	// ---> max codingLine size = w + 1
Lines 3509-3515 void JBIG2Stream::readCodeTableSeg(Guint Link Here
3509	val = lowVal;	3511	val = lowVal;
3510	while (val < highVal) {	3512	while (val < highVal) {
3511	if (i == huffTabSize) {	3513	if (i == huffTabSize) {
3512	huffTabSize *= 2;	3514	huffTabSize = (SafeInt(huffTabSize) * 2).Int();
3513	huffTab = (JBIG2HuffmanTable *)	3515	huffTab = (JBIG2HuffmanTable *)
3514	greallocn(huffTab, huffTabSize, sizeof(JBIG2HuffmanTable));	3516	greallocn(huffTab, huffTabSize, sizeof(JBIG2HuffmanTable));
3515	}	3517	}

Lines 666-672 GBool JPXStream::readBoxes() { Link Here

(-)poppler-0.12.0/poppler/JPXStream.cc (-14 / +14 lines)
666	}	666	}
667	palette.bpc = (Guint *)gmallocn(palette.nComps, sizeof(Guint));	667	palette.bpc = (Guint *)gmallocn(palette.nComps, sizeof(Guint));
668	palette.c =	668	palette.c =
669	(int )gmallocn(palette.nEntries palette.nComps, sizeof(int));	669	(int )gmallocn(SafeInt(palette.nEntries) SafeInt(palette.nComps), sizeof(int));
670	for (i = 0; i < palette.nComps; ++i) {	670	for (i = 0; i < palette.nComps; ++i) {
671	if (!readUByte(&palette.bpc[i])) {	671	if (!readUByte(&palette.bpc[i])) {
672	error(getPos(), "Unexpected EOF in JPX stream");	672	error(getPos(), "Unexpected EOF in JPX stream");
Lines 924-930 GBool JPXStream::readCodestream(Guint le Link Here
924	error(getPos(), "Bad tile count in JPX SIZ marker segment");	924	error(getPos(), "Bad tile count in JPX SIZ marker segment");
925	return gFalse;	925	return gFalse;
926	}	926	}
927	img.tiles = (JPXTile )gmallocn(img.nXTiles img.nYTiles,	927	img.tiles = (JPXTile )gmallocn(SafeInt(img.nXTiles) SafeInt(img.nYTiles),
928	sizeof(JPXTile));	928	sizeof(JPXTile));
929	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {	929	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
930	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,	930	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
Lines 992-998 GBool JPXStream::readCodestream(Guint le Link Here
992	}	992	}
993	img.tiles[i].tileComps[comp].resLevels =	993	img.tiles[i].tileComps[comp].resLevels =
994	(JPXResLevel *)gmallocn(	994	(JPXResLevel *)gmallocn(
995	(img.tiles[i].tileComps[comp].nDecompLevels + 1),	995	(SafeInt(img.tiles[i].tileComps[comp].nDecompLevels) + SafeInt(1)),
996	sizeof(JPXResLevel));	996	sizeof(JPXResLevel));
997	for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) {	997	for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) {
998	img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL;	998	img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL;
Lines 1069-1075 GBool JPXStream::readCodestream(Guint le Link Here
1069	img.tiles[i].tileComps[comp].resLevels =	1069	img.tiles[i].tileComps[comp].resLevels =
1070	(JPXResLevel *)greallocn(	1070	(JPXResLevel *)greallocn(
1071	img.tiles[i].tileComps[comp].resLevels,	1071	img.tiles[i].tileComps[comp].resLevels,
1072	(img.tiles[i].tileComps[comp].nDecompLevels + 1),	1072	(SafeInt(img.tiles[i].tileComps[comp].nDecompLevels) + SafeInt(1)),
1073	sizeof(JPXResLevel));	1073	sizeof(JPXResLevel));
1074	for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) {	1074	for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) {
1075	img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL;	1075	img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL;
Lines 1471-1477 GBool JPXStream::readTilePart() { Link Here
1471	img.tiles[tileIdx].tileComps[comp].resLevels =	1471	img.tiles[tileIdx].tileComps[comp].resLevels =
1472	(JPXResLevel *)greallocn(	1472	(JPXResLevel *)greallocn(
1473	img.tiles[tileIdx].tileComps[comp].resLevels,	1473	img.tiles[tileIdx].tileComps[comp].resLevels,
1474	(img.tiles[tileIdx].tileComps[comp].nDecompLevels + 1),	1474	(SafeInt(img.tiles[tileIdx].tileComps[comp].nDecompLevels) + SafeInt(1)),
1475	sizeof(JPXResLevel));	1475	sizeof(JPXResLevel));
1476	for (r = 0;	1476	for (r = 0;
1477	r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels;	1477	r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels;
Lines 1526-1532 GBool JPXStream::readTilePart() { Link Here
1526	img.tiles[tileIdx].tileComps[comp].resLevels =	1526	img.tiles[tileIdx].tileComps[comp].resLevels =
1527	(JPXResLevel *)greallocn(	1527	(JPXResLevel *)greallocn(
1528	img.tiles[tileIdx].tileComps[comp].resLevels,	1528	img.tiles[tileIdx].tileComps[comp].resLevels,
1529	(img.tiles[tileIdx].tileComps[comp].nDecompLevels + 1),	1529	(SafeInt(img.tiles[tileIdx].tileComps[comp].nDecompLevels) + SafeInt(1)),
1530	sizeof(JPXResLevel));	1530	sizeof(JPXResLevel));
1531	for (r = 0; r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels; ++r) {	1531	for (r = 0; r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels; ++r) {
1532	img.tiles[tileIdx].tileComps[comp].resLevels[r].precincts = NULL;	1532	img.tiles[tileIdx].tileComps[comp].resLevels[r].precincts = NULL;
Lines 1789-1803 GBool JPXStream::readTilePart() { Link Here
1789	tileComp->y1 = jpxCeilDiv(tile->y1, tileComp->hSep);	1789	tileComp->y1 = jpxCeilDiv(tile->y1, tileComp->hSep);
1790	tileComp->cbW = 1 << tileComp->codeBlockW;	1790	tileComp->cbW = 1 << tileComp->codeBlockW;
1791	tileComp->cbH = 1 << tileComp->codeBlockH;	1791	tileComp->cbH = 1 << tileComp->codeBlockH;
1792	tileComp->data = (int )gmallocn((tileComp->x1 - tileComp->x0)	1792	tileComp->data = (int )gmallocn((SafeInt(tileComp->x1) - SafeInt(tileComp->x0))
1793	(tileComp->y1 - tileComp->y0),	1793	(SafeInt(tileComp->y1) - SafeInt(tileComp->y0)),
1794	sizeof(int));	1794	sizeof(int));
1795	if (tileComp->x1 - tileComp->x0 > tileComp->y1 - tileComp->y0) {	1795	if (tileComp->x1 - tileComp->x0 > tileComp->y1 - tileComp->y0) {
1796	n = tileComp->x1 - tileComp->x0;	1796	n = tileComp->x1 - tileComp->x0;
1797	} else {	1797	} else {
1798	n = tileComp->y1 - tileComp->y0;	1798	n = tileComp->y1 - tileComp->y0;
1799	}	1799	}
1800	tileComp->buf = (int *)gmallocn(n + 8, sizeof(int));	1800	tileComp->buf = (int *)gmallocn(SafeInt(n) + SafeInt(8), sizeof(int));
1801	for (r = 0; r <= tileComp->nDecompLevels; ++r) {	1801	for (r = 0; r <= tileComp->nDecompLevels; ++r) {
1802	resLevel = &tileComp->resLevels[r];	1802	resLevel = &tileComp->resLevels[r];
1803	k = r == 0 ? tileComp->nDecompLevels	1803	k = r == 0 ? tileComp->nDecompLevels
Lines 1858-1864 GBool JPXStream::readTilePart() { Link Here
1858	for (level = subband->maxTTLevel; level >= 0; --level) {	1858	for (level = subband->maxTTLevel; level >= 0; --level) {
1859	nx = jpxCeilDivPow2(subband->nXCBs, level);	1859	nx = jpxCeilDivPow2(subband->nXCBs, level);
1860	ny = jpxCeilDivPow2(subband->nYCBs, level);	1860	ny = jpxCeilDivPow2(subband->nYCBs, level);
1861	n += nx * ny;	1861	n += (SafeInt(nx) * SafeInt(ny)).Int();
1862	}	1862	}
1863	subband->inclusion =	1863	subband->inclusion =
1864	(JPXTagTreeNode *)gmallocn(n, sizeof(JPXTagTreeNode));	1864	(JPXTagTreeNode *)gmallocn(n, sizeof(JPXTagTreeNode));
Lines 1870-1877 GBool JPXStream::readTilePart() { Link Here
1870	subband->zeroBitPlane[k].finished = gFalse;	1870	subband->zeroBitPlane[k].finished = gFalse;
1871	subband->zeroBitPlane[k].val = 0;	1871	subband->zeroBitPlane[k].val = 0;
1872	}	1872	}
1873	subband->cbs = (JPXCodeBlock )gmallocn(subband->nXCBs	1873	subband->cbs = (JPXCodeBlock )gmallocn(SafeInt(subband->nXCBs)
1874	subband->nYCBs,	1874	SafeInt(subband->nYCBs),
1875	sizeof(JPXCodeBlock));	1875	sizeof(JPXCodeBlock));
1876	sbx0 = jpxFloorDivPow2(subband->x0, tileComp->codeBlockW);	1876	sbx0 = jpxFloorDivPow2(subband->x0, tileComp->codeBlockW);
1877	sby0 = jpxFloorDivPow2(subband->y0, tileComp->codeBlockH);	1877	sby0 = jpxFloorDivPow2(subband->y0, tileComp->codeBlockH);
Lines 1899-1906 GBool JPXStream::readTilePart() { Link Here
1899	cb->nextPass = jpxPassCleanup;	1899	cb->nextPass = jpxPassCleanup;
1900	cb->nZeroBitPlanes = 0;	1900	cb->nZeroBitPlanes = 0;
1901	cb->coeffs =	1901	cb->coeffs =
1902	(JPXCoeff *)gmallocn((1 << (tileComp->codeBlockW	1902	(JPXCoeff *)gmallocn((SafeInt(1) << (SafeInt(tileComp->codeBlockW)
1903	+ tileComp->codeBlockH)),	1903	+ SafeInt(tileComp->codeBlockH)).Int()),
1904	sizeof(JPXCoeff));	1904	sizeof(JPXCoeff));
1905	for (cbi = 0;	1905	for (cbi = 0;
1906	cbi < (Guint)(1 << (tileComp->codeBlockW	1906	cbi < (Guint)(1 << (tileComp->codeBlockW

Lines 2321-2331 GooString *PSOutputDev::setupExternalCID Link Here

(-)poppler-0.12.0/poppler/PSOutputDev.cc (-5 / +6 lines)
2321	if (fontFileNameLen >= fontFileNameSize) {	2321	if (fontFileNameLen >= fontFileNameSize) {
2322	fontFileNameSize += 64;	2322	fontFileNameSize += 64;
2323	fontFileNames =	2323	fontFileNames =
2324	(GooString **)grealloc(fontFileNames,	2324	(GooString **)greallocn(fontFileNames,
2325	fontFileNameSize * sizeof(GooString *));	2325	fontFileNameSize, sizeof(GooString *));
2326	psFileNames =	2326	psFileNames =
2327	(GooString **)grealloc(psFileNames,	2327	(GooString **)greallocn(psFileNames,
2328	fontFileNameSize * sizeof(GooString *));	2328	fontFileNameSize, sizeof(GooString *));
2329	}	2329	}
2330	}	2330	}
2331	fontFileNames[fontFileNameLen] = myFileName;	2331	fontFileNames[fontFileNameLen] = myFileName;
Lines 4775-4781 void PSOutputDev::doImageL2(Object *ref, Link Here
4775	ImageStream *imgStr;	4775	ImageStream *imgStr;
4776	Guchar *line;	4776	Guchar *line;
4777	PSOutImgClipRect rects0, rects1, rectsTmp, rectsOut;	4777	PSOutImgClipRect rects0, rects1, rectsTmp, rectsOut;
4778	int rects0Len, rects1Len, rectsSize, rectsOutLen, rectsOutSize;	4778	int rects0Len, rects1Len, rectsOutLen;
		4779	SafeInt rectsOutSize, rectsSize;
4779	GBool emitRect, addRect, extendRect;	4780	GBool emitRect, addRect, extendRect;
4780	GooString *s;	4781	GooString *s;
4781	int n, numComps;	4782	int n, numComps;

Lines 378-387 private: Link Here

(-)poppler-0.12.0/poppler/PSOutputDev.h (-6 / +6 lines)
378		378
379	Ref *fontIDs; // list of object IDs of all used fonts	379	Ref *fontIDs; // list of object IDs of all used fonts
380	int fontIDLen; // number of entries in fontIDs array	380	int fontIDLen; // number of entries in fontIDs array
381	int fontIDSize; // size of fontIDs array	381	SafeInt fontIDSize; // size of fontIDs array
382	Ref *fontFileIDs; // list of object IDs of all embedded fonts	382	Ref *fontFileIDs; // list of object IDs of all embedded fonts
383	int fontFileIDLen; // number of entries in fontFileIDs array	383	int fontFileIDLen; // number of entries in fontFileIDs array
384	int fontFileIDSize; // size of fontFileIDs array	384	SafeInt fontFileIDSize; // size of fontFileIDs array
385	GooString **fontFileNames; // list of names of all embedded external fonts	385	GooString **fontFileNames; // list of names of all embedded external fonts
386	GooString **psFileNames; // list of names of all embedded external fonts	386	GooString **psFileNames; // list of names of all embedded external fonts
387	int fontFileNameLen; // number of entries in fontFileNames array	387	int fontFileNameLen; // number of entries in fontFileNames array
Lines 390-405 private: Link Here
390	// font name	390	// font name
391	PSFont8Info *font8Info; // info for 8-bit fonts	391	PSFont8Info *font8Info; // info for 8-bit fonts
392	int font8InfoLen; // number of entries in font8Info array	392	int font8InfoLen; // number of entries in font8Info array
393	int font8InfoSize; // size of font8Info array	393	SafeInt font8InfoSize; // size of font8Info array
394	PSFont16Enc *font16Enc; // encodings for substitute 16-bit fonts	394	PSFont16Enc *font16Enc; // encodings for substitute 16-bit fonts
395	int font16EncLen; // number of entries in font16Enc array	395	int font16EncLen; // number of entries in font16Enc array
396	int font16EncSize; // size of font16Enc array	396	SafeInt font16EncSize; // size of font16Enc array
397	Ref *imgIDs; // list of image IDs for in-memory images	397	Ref *imgIDs; // list of image IDs for in-memory images
398	int imgIDLen; // number of entries in imgIDs array	398	int imgIDLen; // number of entries in imgIDs array
399	int imgIDSize; // size of imgIDs array	399	SafeInt imgIDSize; // size of imgIDs array
400	Ref *formIDs; // list of IDs for predefined forms	400	Ref *formIDs; // list of IDs for predefined forms
401	int formIDLen; // number of entries in formIDs array	401	int formIDLen; // number of entries in formIDs array
402	int formIDSize; // size of formIDs array	402	SafeInt formIDSize; // size of formIDs array
403	GooList *xobjStack; // stack of XObject dicts currently being	403	GooList *xobjStack; // stack of XObject dicts currently being
404	// processed	404	// processed
405	int numSaves; // current number of gsaves	405	int numSaves; // current number of gsaves

Lines 707-714 public: Link Here

(-)poppler-0.12.0/poppler/SplashOutputDev.cc (-9 / +9 lines)
707	int glyphW, glyphH; // size of glyph bitmaps, in pixels	707	int glyphW, glyphH; // size of glyph bitmaps, in pixels
708	GBool validBBox; // false if the bbox was [0 0 0 0]	708	GBool validBBox; // false if the bbox was [0 0 0 0]
709	int glyphSize; // size of glyph bitmaps, in bytes	709	int glyphSize; // size of glyph bitmaps, in bytes
710	int cacheSets; // number of sets in cache	710	SafeInt cacheSets; // number of sets in cache
711	int cacheAssoc; // cache associativity (glyphs per set)	711	SafeInt cacheAssoc; // cache associativity (glyphs per set)
712	Guchar *cacheData; // glyph pixmap cache	712	Guchar *cacheData; // glyph pixmap cache
713	T3FontCacheTag *cacheTags; // cache tags, i.e., char codes	713	T3FontCacheTag *cacheTags; // cache tags, i.e., char codes
714	};	714	};
Lines 765-771 T3FontCache::T3FontCache(Ref *fontIDA, d Link Here
765	cacheTags = (T3FontCacheTag )gmallocn(cacheSets cacheAssoc,	765	cacheTags = (T3FontCacheTag )gmallocn(cacheSets cacheAssoc,
766	sizeof(T3FontCacheTag));	766	sizeof(T3FontCacheTag));
767	for (i = 0; i < cacheSets * cacheAssoc; ++i) {	767	for (i = 0; i < cacheSets * cacheAssoc; ++i) {
768	cacheTags[i].mru = i & (cacheAssoc - 1);	768	cacheTags[i].mru = i & (cacheAssoc.Int() - 1);
769	}	769	}
770	}	770	}
771	else	771	else
Lines 1741-1747 GBool SplashOutputDev::beginType3Char(Gf Link Here
1741	t3Font = t3FontCache[0];	1741	t3Font = t3FontCache[0];
1742		1742
1743	// is the glyph in the cache?	1743	// is the glyph in the cache?
1744	i = (code & (t3Font->cacheSets - 1)) * t3Font->cacheAssoc;	1744	i = (code & (t3Font->cacheSets.Int() - 1)) * t3Font->cacheAssoc.Int();
1745	for (j = 0; j < t3Font->cacheAssoc; ++j) {	1745	for (j = 0; j < t3Font->cacheAssoc; ++j) {
1746	if (t3Font->cacheTags != NULL) {	1746	if (t3Font->cacheTags != NULL) {
1747	if ((t3Font->cacheTags[i+j].mru & 0x8000) &&	1747	if ((t3Font->cacheTags[i+j].mru & 0x8000) &&
Lines 1853-1859 void SplashOutputDev::type3D1(GfxState * Link Here
1853	return;	1853	return;
1854		1854
1855	// allocate a cache entry	1855	// allocate a cache entry
1856	i = (t3GlyphStack->code & (t3Font->cacheSets - 1)) * t3Font->cacheAssoc;	1856	i = (t3GlyphStack->code & (t3Font->cacheSets.Int() - 1)) * t3Font->cacheAssoc.Int();
1857	for (j = 0; j < t3Font->cacheAssoc; ++j) {	1857	for (j = 0; j < t3Font->cacheAssoc; ++j) {
1858	if ((t3Font->cacheTags[i+j].mru & 0x7fff) == t3Font->cacheAssoc - 1) {	1858	if ((t3Font->cacheTags[i+j].mru & 0x7fff) == t3Font->cacheAssoc - 1) {
1859	t3Font->cacheTags[i+j].mru = 0x8000;	1859	t3Font->cacheTags[i+j].mru = 0x8000;
Lines 2282-2288 void SplashOutputDev::drawImage(GfxState Link Here
2282	// build a lookup table here	2282	// build a lookup table here
2283	imgData.lookup = NULL;	2283	imgData.lookup = NULL;
2284	if (colorMap->getNumPixelComps() == 1) {	2284	if (colorMap->getNumPixelComps() == 1) {
2285	n = 1 << colorMap->getBits();	2285	n = (SafeInt(1) << colorMap->getBits()).Int();
2286	switch (colorMode) {	2286	switch (colorMode) {
2287	case splashModeMono1:	2287	case splashModeMono1:
2288	case splashModeMono8:	2288	case splashModeMono8:
Lines 2549-2555 void SplashOutputDev::drawMaskedImage(Gf Link Here
2549	// build a lookup table here	2549	// build a lookup table here
2550	imgData.lookup = NULL;	2550	imgData.lookup = NULL;
2551	if (colorMap->getNumPixelComps() == 1) {	2551	if (colorMap->getNumPixelComps() == 1) {
2552	n = 1 << colorMap->getBits();	2552	n = (SafeInt(1) << colorMap->getBits()).Int();
2553	switch (colorMode) {	2553	switch (colorMode) {
2554	case splashModeMono1:	2554	case splashModeMono1:
2555	case splashModeMono8:	2555	case splashModeMono8:
Lines 2657-2663 void SplashOutputDev::drawSoftMaskedImag Link Here
2657	imgMaskData.width = maskWidth;	2657	imgMaskData.width = maskWidth;
2658	imgMaskData.height = maskHeight;	2658	imgMaskData.height = maskHeight;
2659	imgMaskData.y = 0;	2659	imgMaskData.y = 0;
2660	n = 1 << maskColorMap->getBits();	2660	n = (SafeInt(1) << maskColorMap->getBits()).Int();
2661	imgMaskData.lookup = (SplashColorPtr)gmalloc(n);	2661	imgMaskData.lookup = (SplashColorPtr)gmalloc(n);
2662	for (i = 0; i < n; ++i) {	2662	for (i = 0; i < n; ++i) {
2663	pix = (Guchar)i;	2663	pix = (Guchar)i;
Lines 2694-2700 void SplashOutputDev::drawSoftMaskedImag Link Here
2694	// build a lookup table here	2694	// build a lookup table here
2695	imgData.lookup = NULL;	2695	imgData.lookup = NULL;
2696	if (colorMap->getNumPixelComps() == 1) {	2696	if (colorMap->getNumPixelComps() == 1) {
2697	n = 1 << colorMap->getBits();	2697	n = (SafeInt(1) << maskColorMap->getBits()).Int();
2698	switch (colorMode) {	2698	switch (colorMode) {
2699	case splashModeMono1:	2699	case splashModeMono1:
2700	case splashModeMono8:	2700	case splashModeMono8:

Lines 400-406 ImageStream::ImageStream(Stream *strA, i Link Here

(-)poppler-0.12.0/poppler/Stream.cc (-44 / +44 lines)
400		400
401	nVals = width * nComps;	401	nVals = width * nComps;
402	if (nBits == 1) {	402	if (nBits == 1) {
403	imgLineSize = (nVals + 7) & ~7;	403	imgLineSize = (SafeInt(nVals) + SafeInt(7)).Int() & ~7;
404	} else {	404	} else {
405	imgLineSize = nVals;	405	imgLineSize = nVals;
406	}	406	}
Lines 1352-1359 CCITTFaxStream::CCITTFaxStream(Stream *s Link Here
1352	// ---> max codingLine size = columns + 1	1352	// ---> max codingLine size = columns + 1
1353	// refLine has one extra guard entry at the end	1353	// refLine has one extra guard entry at the end
1354	// ---> max refLine size = columns + 2	1354	// ---> max refLine size = columns + 2
1355	codingLine = (int *)gmallocn_checkoverflow(columns + 1, sizeof(int));	1355	codingLine = (int *)gmallocn_checkoverflow(SafeInt(columns) + SafeInt(1), sizeof(int));
1356	refLine = (int *)gmallocn_checkoverflow(columns + 2, sizeof(int));	1356	refLine = (int *)gmallocn_checkoverflow(SafeInt(columns) + SafeInt(2), sizeof(int));
1357		1357
1358	if (codingLine != NULL && refLine != NULL) {	1358	if (codingLine != NULL && refLine != NULL) {
1359	eof = gFalse;	1359	eof = gFalse;
Lines 2089-2095 void DCTStream::reset() { Link Here
2089	unfilteredReset();	2089	unfilteredReset();
2090		2090
2091	if (!readHeader()) {	2091	if (!readHeader()) {
2092	y = height;	2092	y = height.Int();
2093	return;	2093	return;
2094	}	2094	}
2095		2095
Lines 2134-2145 void DCTStream::reset() { Link Here
2134	if (bufWidth <= 0 \|\| bufHeight <= 0 \|\|	2134	if (bufWidth <= 0 \|\| bufHeight <= 0 \|\|
2135	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {	2135	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
2136	error(getPos(), "Invalid image size in DCT stream");	2136	error(getPos(), "Invalid image size in DCT stream");
2137	y = height;	2137	y = height.Int();
2138	return;	2138	return;
2139	}	2139	}
2140	for (i = 0; i < numComps; ++i) {	2140	for (i = 0; i < numComps; ++i) {
2141	frameBuf[i] = (int )gmallocn(bufWidth bufHeight, sizeof(int));	2141	frameBuf[i] = (int )gmallocn(bufWidth bufHeight, sizeof(int));
2142	memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));	2142	memset(frameBuf[i], 0, (bufWidth * bufHeight * sizeof(int)).Int());
2143	}	2143	}
2144		2144
2145	// read the image data	2145	// read the image data
Lines 2171-2177 void DCTStream::reset() { Link Here
2171	comp = 0;	2171	comp = 0;
2172	x = 0;	2172	x = 0;
2173	y = 0;	2173	y = 0;
2174	dy = mcuHeight;	2174	dy = mcuHeight.Int();
2175		2175
2176	restartMarker = 0xd0;	2176	restartMarker = 0xd0;
2177	restart();	2177	restart();
Lines 2199-2205 int DCTStream::getChar() { Link Here
2199	return EOF;	2199	return EOF;
2200	}	2200	}
2201	if (progressive \|\| !interleaved) {	2201	if (progressive \|\| !interleaved) {
2202	c = frameBuf[comp][y * bufWidth + x];	2202	c = frameBuf[comp][y * bufWidth.Int() + x];
2203	if (++comp == numComps) {	2203	if (++comp == numComps) {
2204	comp = 0;	2204	comp = 0;
2205	if (++x == width) {	2205	if (++x == width) {
Lines 2210-2216 int DCTStream::getChar() { Link Here
2210	} else {	2210	} else {
2211	if (dy >= mcuHeight) {	2211	if (dy >= mcuHeight) {
2212	if (!readMCURow()) {	2212	if (!readMCURow()) {
2213	y = height;	2213	y = height.Int();
2214	return EOF;	2214	return EOF;
2215	}	2215	}
2216	comp = 0;	2216	comp = 0;
Lines 2238-2248 int DCTStream::lookChar() { Link Here
2238	return EOF;	2238	return EOF;
2239	}	2239	}
2240	if (progressive \|\| !interleaved) {	2240	if (progressive \|\| !interleaved) {
2241	return frameBuf[comp][y * bufWidth + x];	2241	return frameBuf[comp][y * bufWidth.Int() + x];
2242	} else {	2242	} else {
2243	if (dy >= mcuHeight) {	2243	if (dy >= mcuHeight) {
2244	if (!readMCURow()) {	2244	if (!readMCURow()) {
2245	y = height;	2245	y = height.Int();
2246	return EOF;	2246	return EOF;
2247	}	2247	}
2248	comp = 0;	2248	comp = 0;
Lines 2274-2280 GBool DCTStream::readMCURow() { Link Here
2274	int x1, x2, y2, x3, y3, x4, y4, x5, y5, cc, i;	2274	int x1, x2, y2, x3, y3, x4, y4, x5, y5, cc, i;
2275	int c;	2275	int c;
2276		2276
2277	for (x1 = 0; x1 < width; x1 += mcuWidth) {	2277	for (x1 = 0; x1 < width; x1 += mcuWidth.Int()) {
2278		2278
2279	// deal with restart marker	2279	// deal with restart marker
2280	if (restartInterval > 0 && restartCtr == 0) {	2280	if (restartInterval > 0 && restartCtr == 0) {
Lines 2292-2299 GBool DCTStream::readMCURow() { Link Here
2292	for (cc = 0; cc < numComps; ++cc) {	2292	for (cc = 0; cc < numComps; ++cc) {
2293	h = compInfo[cc].hSample;	2293	h = compInfo[cc].hSample;
2294	v = compInfo[cc].vSample;	2294	v = compInfo[cc].vSample;
2295	horiz = mcuWidth / h;	2295	horiz = mcuWidth.Int() / h;
2296	vert = mcuHeight / v;	2296	vert = mcuHeight.Int() / v;
2297	hSub = horiz / 8;	2297	hSub = horiz / 8;
2298	vSub = vert / 8;	2298	vSub = vert / 8;
2299	for (y2 = 0; y2 < mcuHeight; y2 += vert) {	2299	for (y2 = 0; y2 < mcuHeight; y2 += vert) {
Lines 2399-2409 void DCTStream::readScan() { Link Here
2399	break;	2399	break;
2400	}	2400	}
2401	}	2401	}
2402	dx1 = mcuWidth / compInfo[cc].hSample;	2402	dx1 = mcuWidth.Int() / compInfo[cc].hSample;
2403	dy1 = mcuHeight / compInfo[cc].vSample;	2403	dy1 = mcuHeight.Int() / compInfo[cc].vSample;
2404	} else {	2404	} else {
2405	dx1 = mcuWidth;	2405	dx1 = mcuWidth.Int();
2406	dy1 = mcuHeight;	2406	dy1 = mcuHeight.Int();
2407	}	2407	}
2408		2408
2409	for (y1 = 0; y1 < height; y1 += dy1) {	2409	for (y1 = 0; y1 < height; y1 += dy1) {
Lines 2430-2443 void DCTStream::readScan() { Link Here
2430		2430
2431	h = compInfo[cc].hSample;	2431	h = compInfo[cc].hSample;
2432	v = compInfo[cc].vSample;	2432	v = compInfo[cc].vSample;
2433	horiz = mcuWidth / h;	2433	horiz = mcuWidth.Int() / h;
2434	vert = mcuHeight / v;	2434	vert = mcuHeight.Int() / v;
2435	vSub = vert / 8;	2435	vSub = vert / 8;
2436	for (y2 = 0; y2 < dy1; y2 += vert) {	2436	for (y2 = 0; y2 < dy1; y2 += vert) {
2437	for (x2 = 0; x2 < dx1; x2 += horiz) {	2437	for (x2 = 0; x2 < dx1; x2 += horiz) {
2438		2438
2439	// pull out the current values	2439	// pull out the current values
2440	p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)];	2440	p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
2441	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {	2441	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
2442	data[i] = p1[0];	2442	data[i] = p1[0];
2443	data[i+1] = p1[1];	2443	data[i+1] = p1[1];
Lines 2447-2453 void DCTStream::readScan() { Link Here
2447	data[i+5] = p1[5];	2447	data[i+5] = p1[5];
2448	data[i+6] = p1[6];	2448	data[i+6] = p1[6];
2449	data[i+7] = p1[7];	2449	data[i+7] = p1[7];
2450	p1 += bufWidth * vSub;	2450	p1 += bufWidth.Int() * vSub;
2451	}	2451	}
2452		2452
2453	// read one data unit	2453	// read one data unit
Lines 2469-2475 void DCTStream::readScan() { Link Here
2469	}	2469	}
2470		2470
2471	// add the data unit into frameBuf	2471	// add the data unit into frameBuf
2472	p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)];	2472	p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
2473	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {	2473	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
2474	p1[0] = data[i];	2474	p1[0] = data[i];
2475	p1[1] = data[i+1];	2475	p1[1] = data[i+1];
Lines 2479-2485 void DCTStream::readScan() { Link Here
2479	p1[5] = data[i+5];	2479	p1[5] = data[i+5];
2480	p1[6] = data[i+6];	2480	p1[6] = data[i+6];
2481	p1[7] = data[i+7];	2481	p1[7] = data[i+7];
2482	p1 += bufWidth * vSub;	2482	p1 += bufWidth.Int() * vSub;
2483	}	2483	}
2484	}	2484	}
2485	}	2485	}
Lines 2676-2696 void DCTStream::decodeImage() { Link Here
2676	int h, v, horiz, vert, hSub, vSub;	2676	int h, v, horiz, vert, hSub, vSub;
2677	int p0, p1, *p2;	2677	int p0, p1, *p2;
2678		2678
2679	for (y1 = 0; y1 < bufHeight; y1 += mcuHeight) {	2679	for (y1 = 0; y1 < bufHeight; y1 += mcuHeight.Int()) {
2680	for (x1 = 0; x1 < bufWidth; x1 += mcuWidth) {	2680	for (x1 = 0; x1 < bufWidth; x1 += mcuWidth.Int()) {
2681	for (cc = 0; cc < numComps; ++cc) {	2681	for (cc = 0; cc < numComps; ++cc) {
2682	quantTable = quantTables[compInfo[cc].quantTable];	2682	quantTable = quantTables[compInfo[cc].quantTable];
2683	h = compInfo[cc].hSample;	2683	h = compInfo[cc].hSample;
2684	v = compInfo[cc].vSample;	2684	v = compInfo[cc].vSample;
2685	horiz = mcuWidth / h;	2685	horiz = mcuWidth.Int() / h;
2686	vert = mcuHeight / v;	2686	vert = mcuHeight.Int() / v;
2687	hSub = horiz / 8;	2687	hSub = horiz / 8;
2688	vSub = vert / 8;	2688	vSub = vert / 8;
2689	for (y2 = 0; y2 < mcuHeight; y2 += vert) {	2689	for (y2 = 0; y2 < mcuHeight; y2 += vert) {
2690	for (x2 = 0; x2 < mcuWidth; x2 += horiz) {	2690	for (x2 = 0; x2 < mcuWidth; x2 += horiz) {
2691		2691
2692	// pull out the coded data unit	2692	// pull out the coded data unit
2693	p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)];	2693	p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
2694	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {	2694	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
2695	dataIn[i] = p1[0];	2695	dataIn[i] = p1[0];
2696	dataIn[i+1] = p1[1];	2696	dataIn[i+1] = p1[1];
Lines 2700-2706 void DCTStream::decodeImage() { Link Here
2700	dataIn[i+5] = p1[5];	2700	dataIn[i+5] = p1[5];
2701	dataIn[i+6] = p1[6];	2701	dataIn[i+6] = p1[6];
2702	dataIn[i+7] = p1[7];	2702	dataIn[i+7] = p1[7];
2703	p1 += bufWidth * vSub;	2703	p1 += bufWidth.Int() * vSub;
2704	}	2704	}
2705		2705
2706	// transform	2706	// transform
Lines 2708-2714 void DCTStream::decodeImage() { Link Here
2708		2708
2709	// store back into frameBuf, doing replication for	2709	// store back into frameBuf, doing replication for
2710	// subsampled components	2710	// subsampled components
2711	p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)];	2711	p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)];
2712	if (hSub == 1 && vSub == 1) {	2712	if (hSub == 1 && vSub == 1) {
2713	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {	2713	for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) {
2714	p1[0] = dataOut[i] & 0xff;	2714	p1[0] = dataOut[i] & 0xff;
Lines 2719-2728 void DCTStream::decodeImage() { Link Here
2719	p1[5] = dataOut[i+5] & 0xff;	2719	p1[5] = dataOut[i+5] & 0xff;
2720	p1[6] = dataOut[i+6] & 0xff;	2720	p1[6] = dataOut[i+6] & 0xff;
2721	p1[7] = dataOut[i+7] & 0xff;	2721	p1[7] = dataOut[i+7] & 0xff;
2722	p1 += bufWidth;	2722	p1 += bufWidth.Int();
2723	}	2723	}
2724	} else if (hSub == 2 && vSub == 2) {	2724	} else if (hSub == 2 && vSub == 2) {
2725	p2 = p1 + bufWidth;	2725	p2 = p1 + bufWidth.Int();
2726	for (y3 = 0, i = 0; y3 < 16; y3 += 2, i += 8) {	2726	for (y3 = 0, i = 0; y3 < 16; y3 += 2, i += 8) {
2727	p1[0] = p1[1] = p2[0] = p2[1] = dataOut[i] & 0xff;	2727	p1[0] = p1[1] = p2[0] = p2[1] = dataOut[i] & 0xff;
2728	p1[2] = p1[3] = p2[2] = p2[3] = dataOut[i+1] & 0xff;	2728	p1[2] = p1[3] = p2[2] = p2[3] = dataOut[i+1] & 0xff;
Lines 2732-2739 void DCTStream::decodeImage() { Link Here
2732	p1[10] = p1[11] = p2[10] = p2[11] = dataOut[i+5] & 0xff;	2732	p1[10] = p1[11] = p2[10] = p2[11] = dataOut[i+5] & 0xff;
2733	p1[12] = p1[13] = p2[12] = p2[13] = dataOut[i+6] & 0xff;	2733	p1[12] = p1[13] = p2[12] = p2[13] = dataOut[i+6] & 0xff;
2734	p1[14] = p1[15] = p2[14] = p2[15] = dataOut[i+7] & 0xff;	2734	p1[14] = p1[15] = p2[14] = p2[15] = dataOut[i+7] & 0xff;
2735	p1 += bufWidth * 2;	2735	p1 += bufWidth.Int() * 2;
2736	p2 += bufWidth * 2;	2736	p2 += bufWidth.Int() * 2;
2737	}	2737	}
2738	} else {	2738	} else {
2739	i = 0;	2739	i = 0;
Lines 2744-2754 void DCTStream::decodeImage() { Link Here
2744	for (x5 = 0; x5 < hSub; ++x5) {	2744	for (x5 = 0; x5 < hSub; ++x5) {
2745	p2[x5] = dataOut[i] & 0xff;	2745	p2[x5] = dataOut[i] & 0xff;
2746	}	2746	}
2747	p2 += bufWidth;	2747	p2 += bufWidth.Int();
2748	}	2748	}
2749	++i;	2749	++i;
2750	}	2750	}
2751	p1 += bufWidth * vSub;	2751	p1 += bufWidth.Int() * vSub;
2752	}	2752	}
2753	}	2753	}
2754	}	2754	}
Lines 2760-2768 void DCTStream::decodeImage() { Link Here
2760	// convert YCbCr to RGB	2760	// convert YCbCr to RGB
2761	if (numComps == 3) {	2761	if (numComps == 3) {
2762	for (y2 = 0; y2 < mcuHeight; ++y2) {	2762	for (y2 = 0; y2 < mcuHeight; ++y2) {
2763	p0 = &frameBuf[0][(y1+y2) * bufWidth + x1];	2763	p0 = &frameBuf[0][(y1+y2) * bufWidth.Int() + x1];
2764	p1 = &frameBuf[1][(y1+y2) * bufWidth + x1];	2764	p1 = &frameBuf[1][(y1+y2) * bufWidth.Int() + x1];
2765	p2 = &frameBuf[2][(y1+y2) * bufWidth + x1];	2765	p2 = &frameBuf[2][(y1+y2) * bufWidth.Int() + x1];
2766	for (x2 = 0; x2 < mcuWidth; ++x2) {	2766	for (x2 = 0; x2 < mcuWidth; ++x2) {
2767	pY = *p0;	2767	pY = *p0;
2768	pCb = *p1 - 128;	2768	pCb = *p1 - 128;
Lines 2779-2787 void DCTStream::decodeImage() { Link Here
2779	// convert YCbCrK to CMYK (K is passed through unchanged)	2779	// convert YCbCrK to CMYK (K is passed through unchanged)
2780	} else if (numComps == 4) {	2780	} else if (numComps == 4) {
2781	for (y2 = 0; y2 < mcuHeight; ++y2) {	2781	for (y2 = 0; y2 < mcuHeight; ++y2) {
2782	p0 = &frameBuf[0][(y1+y2) * bufWidth + x1];	2782	p0 = &frameBuf[0][(y1+y2) * bufWidth.Int() + x1];
2783	p1 = &frameBuf[1][(y1+y2) * bufWidth + x1];	2783	p1 = &frameBuf[1][(y1+y2) * bufWidth.Int() + x1];
2784	p2 = &frameBuf[2][(y1+y2) * bufWidth + x1];	2784	p2 = &frameBuf[2][(y1+y2) * bufWidth.Int() + x1];
2785	for (x2 = 0; x2 < mcuWidth; ++x2) {	2785	for (x2 = 0; x2 < mcuWidth; ++x2) {
2786	pY = *p0;	2786	pY = *p0;
2787	pCb = *p1 - 128;	2787	pCb = *p1 - 128;
Lines 4443-4449 void FlateStream::compHuffmanCodes(int * Link Here
4443	}	4443	}
4444		4444
4445	// allocate the table	4445	// allocate the table
4446	tabSize = 1 << tab->maxLen;	4446	tabSize = (SafeInt(1) << tab->maxLen).Int();
4447	tab->codes = (FlateCode *)gmallocn(tabSize, sizeof(FlateCode));	4447	tab->codes = (FlateCode *)gmallocn(tabSize, sizeof(FlateCode));
4448		4448
4449	// clear the table	4449	// clear the table

Lines 290-296 TextWord::TextWord(GfxState *state, int Link Here

(-)poppler-0.12.0/poppler/TextOutputDev.cc (-51 / +54 lines)
290	text = NULL;	290	text = NULL;
291	charcode = NULL;	291	charcode = NULL;
292	edge = NULL;	292	edge = NULL;
293	len = size = 0;	293	size = len = 0;
294	spaceAfter = gFalse;	294	spaceAfter = gFalse;
295	next = NULL;	295	next = NULL;
296		296
Lines 376-385 void TextWord::merge(TextWord *word) { Link Here
376	yMax = word->yMax;	376	yMax = word->yMax;
377	}	377	}
378	if (len + word->len > size) {	378	if (len + word->len > size) {
379	size = len + word->len;	379	size = SafeInt(len) + SafeInt(word->len);
380	text = (Unicode *)greallocn(text, size, sizeof(Unicode));	380	text = (Unicode *)greallocn(text, size, sizeof(Unicode));
381	charcode = (CharCode *)greallocn(charcode, (size + 1), sizeof(CharCode));	381	charcode = (CharCode *)greallocn(charcode, (size + 1), sizeof(CharCode));
382	edge = (double *)greallocn(edge, (size + 1), sizeof(double));	382	edge = (double *)greallocn(edge, (size + SafeInt(1)), sizeof(double));
383	}	383	}
384	for (i = 0; i < word->len; ++i) {	384	for (i = 0; i < word->len; ++i) {
385	text[len + i] = word->text[i];	385	text[len + i] = word->text[i];
Lines 513-523 TextPool::TextPool() { Link Here
513	}	513	}
514		514
515	TextPool::~TextPool() {	515	TextPool::~TextPool() {
516	int baseIdx;	516	SafeInt baseIdx;
517	TextWord word, word2;	517	TextWord word, word2;
518		518
519	for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) {	519	for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) {
520	for (word = pool[baseIdx - minBaseIdx]; word; word = word2) {	520	for (word = pool[(baseIdx - minBaseIdx).Int()]; word; word = word2) {
521	word2 = word->next;	521	word2 = word->next;
522	delete word;	522	delete word;
523	}	523	}
Lines 530-546 int TextPool::getBaseIdx(double base) { Link Here
530		530
531	baseIdx = (int)(base / textPoolStep);	531	baseIdx = (int)(base / textPoolStep);
532	if (baseIdx < minBaseIdx) {	532	if (baseIdx < minBaseIdx) {
533	return minBaseIdx;	533	return minBaseIdx.Int();
534	}	534	}
535	if (baseIdx > maxBaseIdx) {	535	if (baseIdx > maxBaseIdx) {
536	return maxBaseIdx;	536	return maxBaseIdx.Int();
537	}	537	}
538	return baseIdx;	538	return baseIdx;
539	}	539	}
540		540
541	void TextPool::addWord(TextWord *word) {	541	void TextPool::addWord(TextWord *word) {
542	TextWord **newPool;	542	TextWord **newPool;
543	int wordBaseIdx, newMinBaseIdx, newMaxBaseIdx, baseIdx;	543	SafeInt wordBaseIdx, newMinBaseIdx, newMaxBaseIdx, baseIdx;
544	TextWord w0, w1;	544	TextWord w0, w1;
545		545
546	// expand the array if needed	546	// expand the array if needed
Lines 548-576 void TextPool::addWord(TextWord *word) { Link Here
548	if (minBaseIdx > maxBaseIdx) {	548	if (minBaseIdx > maxBaseIdx) {
549	minBaseIdx = wordBaseIdx - 128;	549	minBaseIdx = wordBaseIdx - 128;
550	maxBaseIdx = wordBaseIdx + 128;	550	maxBaseIdx = wordBaseIdx + 128;
551	pool = (TextWord **)gmallocn(maxBaseIdx - minBaseIdx + 1,	551	pool = (TextWord **)gmallocn(maxBaseIdx - minBaseIdx + SafeInt(1),
552	sizeof(TextWord *));	552	sizeof(TextWord *));
553	for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) {	553	for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) {
554	pool[baseIdx - minBaseIdx] = NULL;	554	pool[(baseIdx - minBaseIdx).Int()] = NULL;
555	}	555	}
556	} else if (wordBaseIdx < minBaseIdx) {	556	} else if (wordBaseIdx < minBaseIdx) {
557	newMinBaseIdx = wordBaseIdx - 128;	557	newMinBaseIdx = wordBaseIdx - 128;
558	newPool = (TextWord **)gmallocn(maxBaseIdx - newMinBaseIdx + 1,	558	newPool = (TextWord **)gmallocn(maxBaseIdx - newMinBaseIdx + SafeInt(1),
559	sizeof(TextWord *));	559	sizeof(TextWord *));
560	for (baseIdx = newMinBaseIdx; baseIdx < minBaseIdx; ++baseIdx) {	560	for (baseIdx = newMinBaseIdx; baseIdx < minBaseIdx; ++baseIdx) {
561	newPool[baseIdx - newMinBaseIdx] = NULL;	561	newPool[(baseIdx - newMinBaseIdx).Int()] = NULL;
562	}	562	}
563	memcpy(&newPool[minBaseIdx - newMinBaseIdx], pool,	563	memcpy(&newPool[(minBaseIdx - newMinBaseIdx).Int()], pool,
564	(maxBaseIdx - minBaseIdx + 1) * sizeof(TextWord *));	564	((maxBaseIdx - minBaseIdx + 1) * sizeof(TextWord *)).Int());
565	gfree(pool);	565	gfree(pool);
566	pool = newPool;	566	pool = newPool;
567	minBaseIdx = newMinBaseIdx;	567	minBaseIdx = newMinBaseIdx;
568	} else if (wordBaseIdx > maxBaseIdx) {	568	} else if (wordBaseIdx > maxBaseIdx) {
569	newMaxBaseIdx = wordBaseIdx + 128;	569	newMaxBaseIdx = wordBaseIdx + 128;
570	pool = (TextWord **)greallocn(pool, newMaxBaseIdx - minBaseIdx + 1,	570	pool = (TextWord **)greallocn(pool, newMaxBaseIdx - minBaseIdx + SafeInt(1),
571	sizeof(TextWord *));	571	sizeof(TextWord *));
572	for (baseIdx = maxBaseIdx + 1; baseIdx <= newMaxBaseIdx; ++baseIdx) {	572	for (baseIdx = maxBaseIdx + 1; baseIdx <= newMaxBaseIdx; ++baseIdx) {
573	pool[baseIdx - minBaseIdx] = NULL;	573	pool[(baseIdx - minBaseIdx).Int()] = NULL;
574	}	574	}
575	maxBaseIdx = newMaxBaseIdx;	575	maxBaseIdx = newMaxBaseIdx;
576	}	576	}
Lines 582-598 void TextPool::addWord(TextWord *word) { Link Here
582	w1 = cursor->next;	582	w1 = cursor->next;
583	} else {	583	} else {
584	w0 = NULL;	584	w0 = NULL;
585	w1 = pool[wordBaseIdx - minBaseIdx];	585	w1 = pool[(wordBaseIdx - minBaseIdx).Int()];
586	}	586	}
587	for (; w1 && word->primaryCmp(w1) > 0; w0 = w1, w1 = w1->next) ;	587	for (; w1 && word->primaryCmp(w1) > 0; w0 = w1, w1 = w1->next) ;
588	word->next = w1;	588	word->next = w1;
589	if (w0) {	589	if (w0) {
590	w0->next = word;	590	w0->next = word;
591	} else {	591	} else {
592	pool[wordBaseIdx - minBaseIdx] = word;	592	pool[(wordBaseIdx - minBaseIdx).Int()] = word;
593	}	593	}
594	cursor = word;	594	cursor = word;
595	cursorBaseIdx = wordBaseIdx;	595	cursorBaseIdx = wordBaseIdx.Int();
596	}	596	}
597		597
598	//------------------------------------------------------------------------	598	//------------------------------------------------------------------------
Lines 802-808 void TextLine::coalesce(UnicodeMap *uMap Link Here
802	}	802	}
803	}	803	}
804	text = (Unicode *)gmallocn(len, sizeof(Unicode));	804	text = (Unicode *)gmallocn(len, sizeof(Unicode));
805	edge = (double *)gmallocn(len + 1, sizeof(double));	805	edge = (double *)gmallocn(len + SafeInt(1), sizeof(double));
806	i = 0;	806	i = 0;
807	for (word1 = words; word1; word1 = word1->next) {	807	for (word1 = words; word1; word1 = word1->next) {
808	for (j = 0; j < word1->len; ++j) {	808	for (j = 0; j < word1->len; ++j) {
Lines 818-824 void TextLine::coalesce(UnicodeMap *uMap Link Here
818	}	818	}
819		819
820	// compute convertedLen and set up the col array	820	// compute convertedLen and set up the col array
821	col = (int *)gmallocn(len + 1, sizeof(int));	821	col = (int *)gmallocn(len + SafeInt(1), sizeof(int));
822	convertedLen = 0;	822	convertedLen = 0;
823	for (i = 0; i < len; ++i) {	823	for (i = 0; i < len; ++i) {
824	col[i] = convertedLen;	824	col[i] = convertedLen;
Lines 828-838 void TextLine::coalesce(UnicodeMap *uMap Link Here
828	convertedLen += uMap->mapUnicode(text[i], buf, sizeof(buf));	828	convertedLen += uMap->mapUnicode(text[i], buf, sizeof(buf));
829	}	829	}
830	}	830	}
831	col[len] = convertedLen;	831	col[len.Int()] = convertedLen;
832		832
833	// check for hyphen at end of line	833	// check for hyphen at end of line
834	//~ need to check for other chars used as hyphens	834	//~ need to check for other chars used as hyphens
835	hyphenated = text[len - 1] == (Unicode)'-';	835	hyphenated = text[(len - 1).Int()] == (Unicode)'-';
836	}	836	}
837		837
838	//------------------------------------------------------------------------	838	//------------------------------------------------------------------------
Lines 1202-1208 void TextBlock::coalesce(UnicodeMap *uMa Link Here
1202	int i, j, k;	1202	int i, j, k;
1203		1203
1204	// discard duplicated text (fake boldface, drop shadows)	1204	// discard duplicated text (fake boldface, drop shadows)
1205	for (idx0 = pool->minBaseIdx; idx0 <= pool->maxBaseIdx; ++idx0) {	1205	for (idx0 = pool->minBaseIdx.Int(); idx0 <= pool->maxBaseIdx.Int(); ++idx0) {
1206	word0 = pool->getPool(idx0);	1206	word0 = pool->getPool(idx0);
1207	while (word0) {	1207	while (word0) {
1208	priDelta = dupMaxPriDelta * word0->fontSize;	1208	priDelta = dupMaxPriDelta * word0->fontSize;
Lines 1266-1272 void TextBlock::coalesce(UnicodeMap *uMa Link Here
1266		1266
1267	// build the lines	1267	// build the lines
1268	curLine = NULL;	1268	curLine = NULL;
1269	poolMinBaseIdx = pool->minBaseIdx;	1269	poolMinBaseIdx = pool->minBaseIdx.Int();
1270	charCount = 0;	1270	charCount = 0;
1271	nLines = 0;	1271	nLines = 0;
1272	while (1) {	1272	while (1) {
Lines 1368-1374 void TextBlock::coalesce(UnicodeMap *uMa Link Here
1368	line->next = line1;	1368	line->next = line1;
1369	curLine = line;	1369	curLine = line;
1370	line->coalesce(uMap);	1370	line->coalesce(uMap);
1371	charCount += line->len;	1371	charCount += line->len.Int();
1372	++nLines;	1372	++nLines;
1373	}	1373	}
1374		1374
Lines 1377-1383 void TextBlock::coalesce(UnicodeMap *uMa Link Here
1377	for (line = lines, i = 0; line; line = line->next, ++i) {	1377	for (line = lines, i = 0; line; line = line->next, ++i) {
1378	lineArray[i] = line;	1378	lineArray[i] = line;
1379	}	1379	}
1380	qsort(lineArray, nLines, sizeof(TextLine *), &TextLine::cmpXY);	1380	qsort(lineArray, nLines.Int(), sizeof(TextLine *), &TextLine::cmpXY);
1381		1381
1382	// column assignment	1382	// column assignment
1383	nColumns = 0;	1383	nColumns = 0;
Lines 1387-1393 void TextBlock::coalesce(UnicodeMap *uMa Link Here
1387	for (j = 0; j < i; ++j) {	1387	for (j = 0; j < i; ++j) {
1388	line1 = lineArray[j];	1388	line1 = lineArray[j];
1389	if (line1->primaryDelta(line0) >= 0) {	1389	if (line1->primaryDelta(line0) >= 0) {
1390	col2 = line1->col[line1->len] + 1;	1390	col2 = line1->col[line1->len.Int()] + 1;
1391	} else {	1391	} else {
1392	k = 0; // make gcc happy	1392	k = 0; // make gcc happy
1393	switch (rot) {	1393	switch (rot) {
Lines 1425-1432 void TextBlock::coalesce(UnicodeMap *uMa Link Here
1425	for (k = 0; k <= line0->len; ++k) {	1425	for (k = 0; k <= line0->len; ++k) {
1426	line0->col[k] += col1;	1426	line0->col[k] += col1;
1427	}	1427	}
1428	if (line0->col[line0->len] > nColumns) {	1428	if (line0->col[line0->len.Int()] > nColumns) {
1429	nColumns = line0->col[line0->len];	1429	nColumns = line0->col[line0->len.Int()];
1430	}	1430	}
1431	}	1431	}
1432	gfree(lineArray);	1432	gfree(lineArray);
Lines 1699-1705 TextWordList::TextWordList(TextPage *tex Link Here
1699	TextLine *line;	1699	TextLine *line;
1700	TextWord *word;	1700	TextWord *word;
1701	TextWord **wordArray;	1701	TextWord **wordArray;
1702	int nWords, i;	1702	SafeInt nWords;
		1703	int i;
1703		1704
1704	words = new GooList();	1705	words = new GooList();
1705		1706
Lines 1732-1738 TextWordList::TextWordList(TextPage *tex Link Here
1732	}	1733	}
1733	}	1734	}
1734	}	1735	}
1735	qsort(wordArray, nWords, sizeof(TextWord *), &TextWord::cmpYX);	1736	qsort(wordArray, nWords.Int(), sizeof(TextWord *), &TextWord::cmpYX);
1736	for (i = 0; i < nWords; ++i) {	1737	for (i = 0; i < nWords; ++i) {
1737	words->append(wordArray[i]);	1738	words->append(wordArray[i]);
1738	}	1739	}
Lines 2193-2199 void TextPage::coalesce(GBool physLayout Link Here
2193	GBool found;	2194	GBool found;
2194	int count[4];	2195	int count[4];
2195	int lrCount;	2196	int lrCount;
2196	int firstBlkIdx, nBlocksLeft;	2197	int firstBlkIdx;
		2198	SafeInt nBlocksLeft;
2197	int col1, col2;	2199	int col1, col2;
2198	int i, j, n;	2200	int i, j, n;
2199		2201
Lines 2379-2385 void TextPage::coalesce(GBool physLayout Link Here
2379	// build blocks for each rotation value	2381	// build blocks for each rotation value
2380	for (rot = 0; rot < 4; ++rot) {	2382	for (rot = 0; rot < 4; ++rot) {
2381	pool = pools[rot];	2383	pool = pools[rot];
2382	poolMinBaseIdx = pool->minBaseIdx;	2384	poolMinBaseIdx = pool->minBaseIdx.Int();
2383	count[rot] = 0;	2385	count[rot] = 0;
2384		2386
2385	// add blocks until no more words are left	2387	// add blocks until no more words are left
Lines 2749-2755 void TextPage::coalesce(GBool physLayout Link Here
2749	for (blk = blkList, i = 0; blk; blk = blk->next, ++i) {	2751	for (blk = blkList, i = 0; blk; blk = blk->next, ++i) {
2750	blocks[i] = blk;	2752	blocks[i] = blk;
2751	}	2753	}
2752	qsort(blocks, nBlocks, sizeof(TextBlock *), &TextBlock::cmpXYPrimaryRot);	2754	qsort(blocks, nBlocks.Int(), sizeof(TextBlock *), &TextBlock::cmpXYPrimaryRot);
2753		2755
2754	// column assignment	2756	// column assignment
2755	for (i = 0; i < nBlocks; ++i) {	2757	for (i = 0; i < nBlocks; ++i) {
Lines 2841-2847 void TextPage::coalesce(GBool physLayout Link Here
2841	//----- reading order sort	2843	//----- reading order sort
2842		2844
2843	// sort blocks into yx order (in preparation for reading order sort)	2845	// sort blocks into yx order (in preparation for reading order sort)
2844	qsort(blocks, nBlocks, sizeof(TextBlock *), &TextBlock::cmpYXPrimaryRot);	2846	qsort(blocks, nBlocks.Int(), sizeof(TextBlock *), &TextBlock::cmpYXPrimaryRot);
2845		2847
2846	// compute space on left and right sides of each block	2848	// compute space on left and right sides of each block
2847	for (i = 0; i < nBlocks; ++i) {	2849	for (i = 0; i < nBlocks; ++i) {
Lines 2881-2887 void TextPage::coalesce(GBool physLayout Link Here
2881	//~ this needs to be adjusted for writing mode (vertical text)	2883	//~ this needs to be adjusted for writing mode (vertical text)
2882	//~ this also needs to account for right-to-left column ordering	2884	//~ this also needs to account for right-to-left column ordering
2883	blkArray = (TextBlock *)gmallocn(nBlocks, sizeof(TextBlock ));	2885	blkArray = (TextBlock *)gmallocn(nBlocks, sizeof(TextBlock ));
2884	memcpy(blkArray, blocks, nBlocks * sizeof(TextBlock *));	2886	memcpy(blkArray, blocks, nBlocks.Int() * sizeof(TextBlock *));
2885	while (flows) {	2887	while (flows) {
2886	flow = flows;	2888	flow = flows;
2887	flows = flows->next;	2889	flows = flows->next;
Lines 3058-3064 GBool TextPage::findText(Unicode *s, int Link Here
3058	xMin0 = xMax0 = yMin0 = yMax0 = 0; // make gcc happy	3060	xMin0 = xMax0 = yMin0 = yMax0 = 0; // make gcc happy
3059	xMin1 = xMax1 = yMin1 = yMax1 = 0; // make gcc happy	3061	xMin1 = xMax1 = yMin1 = yMax1 = 0; // make gcc happy
3060		3062
3061	for (i = backward ? nBlocks - 1 : 0;	3063	for (i = backward ? (nBlocks - 1).Int() : 0;
3062	backward ? i >= 0 : i < nBlocks;	3064	backward ? i >= 0 : i < nBlocks;
3063	i += backward ? -1 : 1) {	3065	i += backward ? -1 : 1) {
3064	blk = blocks[i];	3066	blk = blocks[i];
Lines 3088-3094 GBool TextPage::findText(Unicode *s, int Link Here
3088	}	3090	}
3089		3091
3090	if (!line->normalized)	3092	if (!line->normalized)
3091	line->normalized = unicodeNormalizeNFKC(line->text, line->len,	3093	line->normalized = unicodeNormalizeNFKC(line->text, line->len.Int(),
3092	&line->normalized_len,	3094	&line->normalized_len,
3093	&line->normalized_idx);	3095	&line->normalized_idx);
3094	// convert the line to uppercase	3096	// convert the line to uppercase
Lines 3218-3224 GooString *TextPage::getText(double xMin Link Here
3218	TextBlock *blk;	3220	TextBlock *blk;
3219	TextLine *line;	3221	TextLine *line;
3220	TextLineFrag *frags;	3222	TextLineFrag *frags;
3221	int nFrags, fragsSize;	3223	int nFrags;
		3224	SafeInt fragsSize;
3222	TextLineFrag *frag;	3225	TextLineFrag *frag;
3223	char space[8], eol[16];	3226	char space[8], eol[16];
3224	int spaceLen, eolLen;	3227	int spaceLen, eolLen;
Lines 3281-3287 GooString *TextPage::getText(double xMin Link Here
3281	}	3284	}
3282	++j;	3285	++j;
3283	}	3286	}
3284	j = line->len - 1;	3287	j = (line->len - 1).Int();
3285	while (j >= 0) {	3288	while (j >= 0) {
3286	if (0.5 * (line->edge[j] + line->edge[j+1]) < xMax) {	3289	if (0.5 * (line->edge[j] + line->edge[j+1]) < xMax) {
3287	idx1 = j;	3290	idx1 = j;
Lines 3302-3308 GooString *TextPage::getText(double xMin Link Here
3302	}	3305	}
3303	++j;	3306	++j;
3304	}	3307	}
3305	j = line->len - 1;	3308	j = (line->len - 1).Int();
3306	while (j >= 0) {	3309	while (j >= 0) {
3307	if (0.5 * (line->edge[j] + line->edge[j+1]) < yMax) {	3310	if (0.5 * (line->edge[j] + line->edge[j+1]) < yMax) {
3308	idx1 = j;	3311	idx1 = j;
Lines 3323-3329 GooString *TextPage::getText(double xMin Link Here
3323	}	3326	}
3324	++j;	3327	++j;
3325	}	3328	}
3326	j = line->len - 1;	3329	j = (line->len - 1).Int();
3327	while (j >= 0) {	3330	while (j >= 0) {
3328	if (0.5 * (line->edge[j] + line->edge[j+1]) > xMin) {	3331	if (0.5 * (line->edge[j] + line->edge[j+1]) > xMin) {
3329	idx1 = j;	3332	idx1 = j;
Lines 3344-3350 GooString *TextPage::getText(double xMin Link Here
3344	}	3347	}
3345	++j;	3348	++j;
3346	}	3349	}
3347	j = line->len - 1;	3350	j = (line->len - 1).Int();
3348	while (j >= 0) {	3351	while (j >= 0) {
3349	if (0.5 * (line->edge[j] + line->edge[j+1]) > yMin) {	3352	if (0.5 * (line->edge[j] + line->edge[j+1]) > yMin) {
3350	idx1 = j;	3353	idx1 = j;
Lines 3833-3839 void TextLine::visitSelection(TextSelect Link Here
3833	}	3836	}
3834	}	3837	}
3835		3838
3836	edge_begin = len;	3839	edge_begin = len.Int();
3837	edge_end = 0;	3840	edge_end = 0;
3838	for (i = 0; i < len; i++) {	3841	for (i = 0; i < len; i++) {
3839	double mid = (edge[i] + edge[i + 1]) / 2;	3842	double mid = (edge[i] + edge[i + 1]) / 2;
Lines 3899-3906 void TextBlock::visitSelection(TextSelec Link Here
3899	}	3902	}
3900		3903
3901	if (((selection->x1 > p->xMin && selection->y1 > p->yMin) \|\|	3904	if (((selection->x1 > p->xMin && selection->y1 > p->yMin) \|\|
3902	(selection->x2 > p->xMin && selection->y2 > p->yMin))	3905	(selection->x2 > p->xMin && selection->y2 > p->yMin)) && (begin != NULL))
3903	&& (begin != NULL))
3904	end = p->next;	3906	end = p->next;
3905	}	3907	}
3906		3908
Lines 3939-3945 void TextPage::visitSelection(TextSelect Link Here
3939	double start_x, start_y, stop_x, stop_y;	3941	double start_x, start_y, stop_x, stop_y;
3940	TextBlock *b;	3942	TextBlock *b;
3941		3943
3942	begin = nBlocks;	3944	begin = nBlocks.Int();
3943	end = 0;	3945	end = 0;
3944	start_x = selection->x1;	3946	start_x = selection->x1;
3945	start_y = selection->y1;	3947	start_y = selection->y1;
Lines 4134-4140 void TextPage::dump(void *outputStream, Link Here
4134	TextLine *line;	4136	TextLine *line;
4135	TextLineFrag *frags;	4137	TextLineFrag *frags;
4136	TextWord *word;	4138	TextWord *word;
4137	int nFrags, fragsSize;	4139	int nFrags;
		4140	SafeInt fragsSize;
4138	TextLineFrag *frag;	4141	TextLineFrag *frag;
4139	char space[8], eol[16], eop[8];	4142	char space[8], eol[16], eop[8];
4140	int spaceLen, eolLen, eopLen;	4143	int spaceLen, eolLen, eopLen;
Lines 4200-4206 void TextPage::dump(void *outputStream, Link Here
4200	frags = (TextLineFrag *)greallocn(frags,	4203	frags = (TextLineFrag *)greallocn(frags,
4201	fragsSize, sizeof(TextLineFrag));	4204	fragsSize, sizeof(TextLineFrag));
4202	}	4205	}
4203	frags[nFrags].init(line, 0, line->len);	4206	frags[nFrags].init(line, 0, line->len.Int());
4204	frags[nFrags].computeCoords(gTrue);	4207	frags[nFrags].computeCoords(gTrue);
4205	++nFrags;	4208	++nFrags;
4206	}	4209	}
Lines 4277-4283 void TextPage::dump(void *outputStream, Link Here
4277	for (flow = flows; flow; flow = flow->next) {	4280	for (flow = flows; flow; flow = flow->next) {
4278	for (blk = flow->blocks; blk; blk = blk->next) {	4281	for (blk = flow->blocks; blk; blk = blk->next) {
4279	for (line = blk->lines; line; line = line->next) {	4282	for (line = blk->lines; line; line = line->next) {
4280	n = line->len;	4283	n = line->len.Int();
4281	if (line->hyphenated && (line->next \|\| blk->next)) {	4284	if (line->hyphenated && (line->next \|\| blk->next)) {
4282	--n;	4285	--n;
4283	}	4286	}

Lines 176-182 private: Link Here

(-)poppler-0.12.0/poppler/TextOutputDev.h (-9 / +9 lines)
176	double *edge; // "near" edge x or y coord of each char	176	double *edge; // "near" edge x or y coord of each char
177	// (plus one extra entry for the last char)	177	// (plus one extra entry for the last char)
178	int len; // length of text and edge arrays	178	int len; // length of text and edge arrays
179	int size; // size of text and edge arrays	179	SafeInt size; // size of text and edge arrays
180	int charPos; // character position (within content stream)	180	int charPos; // character position (within content stream)
181	int charLen; // number of content stream characters in	181	int charLen; // number of content stream characters in
182	// this word	182	// this word
Lines 216-223 public: Link Here
216	TextPool();	216	TextPool();
217	~TextPool();	217	~TextPool();
218		218
219	TextWord *getPool(int baseIdx) { return pool[baseIdx - minBaseIdx]; }	219	TextWord *getPool(int baseIdx) { return pool[(baseIdx - minBaseIdx).Int()]; }
220	void setPool(int baseIdx, TextWord *p) { pool[baseIdx - minBaseIdx] = p; }	220	void setPool(int baseIdx, TextWord *p) { pool[(baseIdx - minBaseIdx).Int()] = p; }
221		221
222	int getBaseIdx(double base);	222	int getBaseIdx(double base);
223		223
Lines 225-232 public: Link Here
225		225
226	private:	226	private:
227		227
228	int minBaseIdx; // min baseline bucket index	228	SafeInt minBaseIdx; // min baseline bucket index
229	int maxBaseIdx; // max baseline bucket index	229	SafeInt maxBaseIdx; // max baseline bucket index
230	TextWord **pool; // array of linked lists, one for each	230	TextWord **pool; // array of linked lists, one for each
231	// baseline value (multiple of 4 pts)	231	// baseline value (multiple of 4 pts)
232	TextWord *cursor; // pointer to last-accessed word	232	TextWord *cursor; // pointer to last-accessed word
Lines 296-302 private: Link Here
296	double *edge; // "near" edge x or y coord of each char	296	double *edge; // "near" edge x or y coord of each char
297	// (plus one extra entry for the last char)	297	// (plus one extra entry for the last char)
298	int *col; // starting column number of each Unicode char	298	int *col; // starting column number of each Unicode char
299	int len; // number of Unicode chars	299	SafeInt len; // number of Unicode chars
300	int convertedLen; // total number of converted characters	300	int convertedLen; // total number of converted characters
301	GBool hyphenated; // set if last char is a hyphen	301	GBool hyphenated; // set if last char is a hyphen
302	TextLine *next; // next line in block	302	TextLine *next; // next line in block
Lines 357-363 public: Link Here
357	void getBBox(double xMinA, double yMinA, double xMaxA, double yMaxA)	357	void getBBox(double xMinA, double yMinA, double xMaxA, double yMaxA)
358	{ xMinA = xMin; yMinA = yMin; xMaxA = xMax; yMaxA = yMax; }	358	{ xMinA = xMin; yMinA = yMin; xMaxA = xMax; yMaxA = yMax; }
359		359
360	int getLineCount() { return nLines; }	360	int getLineCount() { return nLines.Int(); }
361		361
362	private:	362	private:
363		363
Lines 371-377 private: Link Here
371	// are built)	371	// are built)
372	TextLine *lines; // linked list of lines	372	TextLine *lines; // linked list of lines
373	TextLine *curLine; // most recently added line	373	TextLine *curLine; // most recently added line
374	int nLines; // number of lines	374	SafeInt nLines; // number of lines
375	int charCount; // number of characters in the block	375	int charCount; // number of characters in the block
376	int col; // starting column	376	int col; // starting column
377	int nColumns; // number of columns in the block	377	int nColumns; // number of columns in the block
Lines 584-590 private: Link Here
584	TextPool *pools[4]; // a "pool" of TextWords for each rotation	584	TextPool *pools[4]; // a "pool" of TextWords for each rotation
585	TextFlow *flows; // linked list of flows	585	TextFlow *flows; // linked list of flows
586	TextBlock **blocks; // array of blocks, in yx order	586	TextBlock **blocks; // array of blocks, in yx order
587	int nBlocks; // number of blocks	587	SafeInt nBlocks; // number of blocks
588	int primaryRot; // primary rotation	588	int primaryRot; // primary rotation
589	GBool primaryLR; // primary direction (true means L-to-R,	589	GBool primaryLR; // primary direction (true means L-to-R,
590	// false means R-to-L)	590	// false means R-to-L)

Lines 399-405 GBool XRef::readXRefTable(Parser *parser Link Here

(-)poppler-0.12.0/poppler/XRef.cc (-11 / +13 lines)
399	GBool more;	399	GBool more;
400	Object obj, obj2;	400	Object obj, obj2;
401	Guint pos2;	401	Guint pos2;
402	int first, n, newSize, i;	402	int first, n, i;
		403	SafeInt newSize;
403		404
404	while (1) {	405	while (1) {
405	parser->getObj(&obj);	406	parser->getObj(&obj);
Lines 421-427 GBool XRef::readXRefTable(Parser *parser Link Here
421	goto err1;	422	goto err1;
422	}	423	}
423	if (first + n > size) {	424	if (first + n > size) {
424	for (newSize = size ? 2 * size : 1024;	425	for (newSize = size ? SafeInt(2) * SafeInt(size) : 1024;
425	first + n > newSize && newSize > 0;	426	first + n > newSize && newSize > 0;
426	newSize <<= 1) ;	427	newSize <<= 1) ;
427	if (newSize < 0) {	428	if (newSize < 0) {
Lines 440-446 GBool XRef::readXRefTable(Parser *parser Link Here
440	entries[i].updated = false;	441	entries[i].updated = false;
441	entries[i].gen = 0;	442	entries[i].gen = 0;
442	}	443	}
443	size = newSize;	444	size = newSize.Int();
444	}	445	}
445	for (i = first; i < first + n; ++i) {	446	for (i = first; i < first + n; ++i) {
446	if (!parser->getObj(&obj)->isInt()) {	447	if (!parser->getObj(&obj)->isInt()) {
Lines 628-640 GBool XRef::readXRefStream(Stream *xrefS Link Here
628		629
629	GBool XRef::readXRefStreamSection(Stream xrefStr, int w, int first, int n) {	630	GBool XRef::readXRefStreamSection(Stream xrefStr, int w, int first, int n) {
630	Guint offset;	631	Guint offset;
631	int type, gen, c, newSize, i, j;	632	int type, gen, c, i, j;
		633	SafeInt newSize;
632		634
633	if (first + n < 0) {	635	if (first + n < 0) {
634	return gFalse;	636	return gFalse;
635	}	637	}
636	if (first + n > size) {	638	if (first + n > size) {
637	for (newSize = size ? 2 * size : 1024;	639	for (newSize = size ? SafeInt(2) * SafeInt(size) : 1024;
638	first + n > newSize && newSize > 0;	640	first + n > newSize && newSize > 0;
639	newSize <<= 1) ;	641	newSize <<= 1) ;
640	if (newSize < 0) {	642	if (newSize < 0) {
Lines 652-658 GBool XRef::readXRefStreamSection(Stream Link Here
652	entries[i].updated = false;	654	entries[i].updated = false;
653	entries[i].gen = 0;	655	entries[i].gen = 0;
654	}	656	}
655	size = newSize;	657	size = newSize.Int();
656	}	658	}
657	for (i = first; i < first + n; ++i) {	659	for (i = first; i < first + n; ++i) {
658	if (w[0] == 0) {	660	if (w[0] == 0) {
Lines 710-717 GBool XRef::constructXRef() { Link Here
710	char buf[256];	712	char buf[256];
711	Guint pos;	713	Guint pos;
712	int num, gen;	714	int num, gen;
713	int newSize;	715	SafeInt newSize;
714	int streamEndsSize;	716	SafeInt streamEndsSize;
715	char *p;	717	char *p;
716	int i;	718	int i;
717	GBool gotRoot;	719	GBool gotRoot;
Lines 722-728 GBool XRef::constructXRef() { Link Here
722		724
723	error(-1, "PDF file is damaged - attempting to reconstruct xref table...");	725	error(-1, "PDF file is damaged - attempting to reconstruct xref table...");
724	gotRoot = gFalse;	726	gotRoot = gFalse;
725	streamEndsLen = streamEndsSize = 0;	727	streamEndsSize = streamEndsLen = 0;
726		728
727	str->reset();	729	str->reset();
728	while (1) {	730	while (1) {
Lines 781-787 GBool XRef::constructXRef() { Link Here
781	} while (p && isspace(p));	783	} while (p && isspace(p));
782	if (!strncmp(p, "obj", 3)) {	784	if (!strncmp(p, "obj", 3)) {
783	if (num >= size) {	785	if (num >= size) {
784	newSize = (num + 1 + 255) & ~255;	786	newSize = (SafeInt(num) + 1 + 255).Int() & ~255;
785	if (newSize < 0) {	787	if (newSize < 0) {
786	error(-1, "Bad object number");	788	error(-1, "Bad object number");
787	return gFalse;	789	return gFalse;
Lines 798-804 GBool XRef::constructXRef() { Link Here
798	entries[i].obj.initNull ();	800	entries[i].obj.initNull ();
799	entries[i].updated = false;	801	entries[i].updated = false;
800	}	802	}
801	size = newSize;	803	size = newSize.Int();
802	}	804	}
803	if (entries[num].type == xrefEntryFree \|\|	805	if (entries[num].type == xrefEntryFree \|\|
804	gen >= entries[num].gen) {	806	gen >= entries[num].gen) {