Bugzilla – Attachment 337644 Details for
Bug 570183
libpoppler security upgrade breaks xpdf
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
new safeint patch
poppler-CVE-2009-0791-safe-int.patch (text/plain), 136.16 KB, created by
Marcus Meissner
on 2010-01-20 12:53:02 UTC
(
hide
)
Description:
new safeint patch
Filename:
MIME Type:
Creator:
Marcus Meissner
Created:
2010-01-20 12:53:02 UTC
Size:
136.16 KB
patch
obsolete
>Index: poppler-0.12.0/goo/gmem.cc >=================================================================== >--- poppler-0.12.0.orig/goo/gmem.cc >+++ poppler-0.12.0/goo/gmem.cc >@@ -189,14 +189,335 @@ void *grealloc_checkoverflow(void *p, si > return grealloc(p, size, true); > } > >-inline static void *gmallocn(int nObjs, int objSize, bool checkoverflow) GMEM_EXCEP { >- int n; >+SafeInt::SafeInt(const long long int cA) >+{ >+ if (cA < -INT_MAX || INT_MAX < cA) >+ integer_overflow("SafeInt::SafeInt(long long): "); >+ c = cA; >+} >+ >+SafeInt::SafeInt() >+{ } >+ >+SafeInt::SafeInt(const SafeInt& copy): c(copy.c) >+{ } >+ >+SafeInt SafeInt::create(const long long int cA) >+{ >+ return SafeInt(cA); >+} >+ >+int SafeInt::Int(void) const >+{ >+ return c; >+} >+ >+void SafeInt::integer_overflow(const char * prefix) >+{ >+ fprintf(stderr, "error: %sinteger overflow", prefix); >+ exit (1); >+} >+ >+void SafeInt::division_by_zero(const char * prefix) >+{ >+ fprintf(stderr, "error: %sdivide by zero", prefix); >+ exit(1); >+} >+ >+void SafeInt::shift_is_negative(const char * prefix) >+{ >+ fprintf(stderr, "warning: %sbitwise shift amount is negative", prefix); >+} >+ >+SafeInt& SafeInt::operator=(const int& cA) >+{ >+ *this = SafeInt(cA); >+ return *this; >+} >+ >+bool SafeInt::operator==(const SafeInt& right) const >+{ >+ return c == right.c; >+} >+ >+bool SafeInt::operator!=(const SafeInt& right) const >+{ >+ return c != right.c; >+} >+ >+bool SafeInt::operator<(const SafeInt& right) const >+{ >+ return c < right.c; >+} >+ >+bool SafeInt::operator<=(const SafeInt& right) const >+{ >+ return c <= right.c; >+} >+ >+bool SafeInt::operator>(const SafeInt& right) const >+{ >+ return c > right.c; >+} >+ >+bool SafeInt::operator>=(const SafeInt& right) const >+{ >+ return c >= right.c; >+} >+ >+bool SafeInt::operator==(const int& right) const >+{ >+ return c == right; >+} >+ >+bool SafeInt::operator!=(const int& right) const >+{ >+ return c != right; >+} >+ >+bool SafeInt::operator<(const int& right) const >+{ >+ return c < right; >+} >+ >+bool SafeInt::operator<=(const int& right) const >+{ >+ return c <= right; >+} >+ >+bool SafeInt::operator>(const int& right) const >+{ >+ return c > right; >+} >+ >+bool SafeInt::operator>=(const int& right) const >+{ >+ return c >= right; >+} >+ >+bool operator==(const int& left, const SafeInt& right) >+{ >+ return left == right.c; >+} >+ >+bool operator!=(const int& left, const SafeInt& right) >+{ >+ return left != right.c; >+} >+ >+bool operator<(const int& left, const SafeInt& right) >+{ >+ return left < right.c; >+} >+ >+bool operator<=(const int& left, const SafeInt& right) >+{ >+ return left <= right.c; >+} >+ >+bool operator>(const int& left, const SafeInt& right) >+{ >+ return left > right.c; >+} >+ >+bool operator>=(const int& left, const SafeInt& right) >+{ >+ return left >= right.c; >+} >+ >+SafeInt SafeInt::operator+() const >+{ >+ return SafeInt(*this); >+} >+ >+SafeInt SafeInt::operator+(const SafeInt& right) const >+{ >+ if (c*right.c > 0 && >+ ((c > 0 && c > INT_MAX - right.c) || >+ (c < 0 && c < -INT_MAX - right.c))) >+ integer_overflow("SafeInt::operator+(): "); >+ return SafeInt(c + right.c); >+} >+ >+SafeInt SafeInt::operator-() const >+{ >+ return SafeInt(-c); >+} >+ >+SafeInt SafeInt::operator-(const SafeInt& right) const >+{ >+ return *this + (-right); >+} >+ >+SafeInt SafeInt::operator*(const SafeInt& right) const >+{ >+ if (right.c != 0 && c*right.c/right.c != c) >+ integer_overflow("SafeInt::operator*(): "); >+ return SafeInt(c * right.c); >+} >+ >+SafeInt SafeInt::operator/(const SafeInt& right) const >+{ >+ return SafeInt(c / right.c); >+} > >- if (nObjs == 0) { >+SafeInt SafeInt::operator%(const SafeInt& right) const >+{ >+ return SafeInt(c % right.c); >+} >+ >+SafeInt SafeInt::operator/(const int& right) const >+{ >+ if (right == 0) >+ division_by_zero("SafeInt::operator/(): "); >+ return SafeInt(c / right); >+} >+ >+SafeInt SafeInt::operator%(const int& right) const >+{ >+ return SafeInt(c % right); >+} >+ >+SafeInt& SafeInt::operator+=(const SafeInt& right) >+{ >+ *this = *this + right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator-=(const SafeInt& right) >+{ >+ *this = *this - right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator*=(const SafeInt& right) >+{ >+ *this = *this * right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator/=(const SafeInt& right) >+{ >+ *this = *this / right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator%=(const SafeInt& right) >+{ >+ *this = *this % right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator/=(const int& right) >+{ >+ *this = *this / right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator%=(const int& right) >+{ >+ *this = *this % right; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator++() >+{ >+ *this += one; >+ return *this; >+} >+ >+SafeInt SafeInt::operator++(int) >+{ >+ SafeInt res(*this); >+ *this += one; >+ return res; >+} >+ >+SafeInt& SafeInt::operator--() >+{ >+ *this -= one; >+ return *this; >+} >+ >+SafeInt SafeInt::operator--(int) >+{ >+ SafeInt res(*this); >+ *this -= one; >+ return res; >+} >+ >+SafeInt operator+(const int& left, const SafeInt& right) >+{ >+ return SafeInt(left) + right; >+} >+ >+SafeInt operator-(const int& left, const SafeInt& right) >+{ >+ return SafeInt(left) - right; >+} >+ >+SafeInt operator*(const int& left, const SafeInt& right) >+{ >+ return SafeInt(left) * right; >+} >+ >+SafeInt operator/(const int& left, const SafeInt& right) >+{ >+ return SafeInt(left) / right; >+} >+ >+SafeInt operator%(const int& left, const SafeInt& right) >+{ >+ return SafeInt(left) % right; >+} >+ >+SafeInt SafeInt::operator<<(const int offset) >+{ >+ if (offset < 0) >+ { >+ shift_is_negative("SafeInt::operator<<(): "); >+ return *this >> -offset; >+ } >+ >+ if ((c & (-1 << (sizeof(c)*8 - offset))) != 0) >+ integer_overflow("SafeInt::operator<<(): "); >+ return SafeInt(c << offset); >+} >+ >+SafeInt SafeInt::operator>>(const int offset) >+{ >+ if (offset < 0) >+ { >+ shift_is_negative("SafeInt::operator>>(): "); >+ return *this << -offset; >+ } >+ >+ return SafeInt(c >> offset); >+} >+ >+SafeInt& SafeInt::operator<<=(const int offset) >+{ >+ *this = *this << offset; >+ return *this; >+} >+ >+SafeInt& SafeInt::operator>>=(const int offset) >+{ >+ *this = *this >> offset; >+ return *this; >+} >+ >+const SafeInt SafeInt::zero = SafeInt(0); >+const SafeInt SafeInt::one = SafeInt(1); >+ >+inline static void *gmallocn(SafeInt nObjs, SafeInt objSize, bool checkoverflow) GMEM_EXCEP { >+ SafeInt n; >+ >+ if (nObjs == SafeInt::create(0)) { > return NULL; > } > n = nObjs * objSize; >- if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { >+ if (objSize <= SafeInt::create(0) || nObjs < SafeInt::create(0)) { > #if USE_EXCEPTIONS > throw GMemException(); > #else >@@ -205,13 +526,21 @@ inline static void *gmallocn(int nObjs, > else exit(1); > #endif > } >- return gmalloc(n, checkoverflow); >+ return gmalloc(n.Int(), checkoverflow); >+} >+ >+void *gmallocn(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP { >+ return gmallocn(nObjs, objSize, false); > } > > void *gmallocn(int nObjs, int objSize) GMEM_EXCEP { > return gmallocn(nObjs, objSize, false); > } > >+void *gmallocn_checkoverflow(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP { >+ return gmallocn(nObjs, objSize, true); >+} >+ > void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP { > return gmallocn(nObjs, objSize, true); > } >@@ -238,17 +567,17 @@ void *gmallocn3_checkoverflow(int a, int > return gmallocn3(a, b, c, true); > } > >-inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflow) GMEM_EXCEP { >- int n; >+inline static void *greallocn(void *p, SafeInt nObjs, SafeInt objSize, bool checkoverflow) GMEM_EXCEP { >+ SafeInt n; > >- if (nObjs == 0) { >+ if (nObjs == SafeInt::create(0)) { > if (p) { > gfree(p); > } > return NULL; > } > n = nObjs * objSize; >- if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { >+ if (objSize <= SafeInt::create(0) || nObjs < SafeInt::create(0)) { > #if USE_EXCEPTIONS > throw GMemException(); > #else >@@ -257,13 +586,22 @@ inline static void *greallocn(void *p, i > else exit(1); > #endif > } >- return grealloc(p, n, checkoverflow); >+ return grealloc(p, n.Int(), checkoverflow); >+} >+ >+void *greallocn(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP { >+ return greallocn(p, nObjs, objSize, false); > } > > void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP { > return greallocn(p, nObjs, objSize, false); > } > >+ >+void *greallocn_checkoverflow(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP { >+ return greallocn(p, nObjs, objSize, true); >+} >+ > void *greallocn_checkoverflow(void *p, int nObjs, int objSize) GMEM_EXCEP { > return greallocn(p, nObjs, objSize, true); > } >Index: poppler-0.12.0/goo/gmem.h >=================================================================== >--- poppler-0.12.0.orig/goo/gmem.h >+++ poppler-0.12.0/goo/gmem.h >@@ -45,6 +45,100 @@ public: > #endif // USE_EXCEPTIONS > > #ifdef __cplusplus >+class SafeInt >+{ >+ int c; >+ >+public: >+ SafeInt(); >+ SafeInt(const SafeInt& copy); >+ SafeInt(const long long int cA); >+ static SafeInt create(const long long int cA); >+ int Int(void) const; >+ >+ const static SafeInt zero; >+ const static SafeInt one; >+ >+ static void integer_overflow(const char * prefix = NULL); >+ static void division_by_zero(const char * prefix = NULL); >+ static void shift_is_negative(const char * prefix = NULL); >+ >+ SafeInt& operator=(const int& cA); >+ >+ bool operator==(const SafeInt& right) const; >+ bool operator!=(const SafeInt& right) const; >+ bool operator<(const SafeInt& right) const; >+ bool operator<=(const SafeInt& right) const; >+ bool operator >(const SafeInt& right) const; >+ bool operator >=(const SafeInt& right) const; >+ >+ bool operator==(const int& right) const; >+ bool operator!=(const int& right) const; >+ bool operator<(const int& right) const; >+ bool operator<=(const int& right) const; >+ bool operator >(const int& right) const; >+ bool operator >=(const int& right) const; >+ >+ friend bool operator ==(const int &left, const SafeInt& right); >+ friend bool operator !=(const int &left, const SafeInt& right); >+ friend bool operator <(const int &left, const SafeInt& right); >+ friend bool operator <=(const int &left, const SafeInt& right); >+ friend bool operator >(const int &left, const SafeInt& right); >+ friend bool operator >=(const int &left, const SafeInt& right); >+ >+ SafeInt operator+() const; >+ SafeInt operator+(const SafeInt& right) const; >+ SafeInt operator-() const; >+ SafeInt operator-(const SafeInt& right) const; >+ SafeInt operator*(const SafeInt& right) const; >+ SafeInt operator/(const SafeInt& right) const; >+ SafeInt operator%(const SafeInt& right) const; >+ >+ SafeInt operator/(const int& right) const; >+ SafeInt operator%(const int& right) const; >+ >+ SafeInt& operator+=(const SafeInt& right); >+ SafeInt& operator-=(const SafeInt& right); >+ SafeInt& operator*=(const SafeInt& right); >+ SafeInt& operator/=(const SafeInt& right); >+ SafeInt& operator%=(const SafeInt& right); >+ >+ SafeInt& operator/=(const int& right); >+ SafeInt& operator%=(const int& right); >+ >+ friend SafeInt operator+(const int& left, const SafeInt& right); >+ friend SafeInt operator-(const int& left, const SafeInt& right); >+ friend SafeInt operator*(const int& left, const SafeInt& right); >+ friend SafeInt operator/(const int& left, const SafeInt& right); >+ friend SafeInt operator%(const int& left, const SafeInt& right); >+ >+ SafeInt& operator++(); >+ SafeInt operator++(int); >+ SafeInt& operator--(); >+ SafeInt operator--(int); >+ >+ SafeInt operator<<(const int offset); >+ SafeInt operator>>(const int offset); >+ >+ SafeInt& operator<<=(const int offset); >+ SafeInt& operator>>=(const int offset); >+}; >+ >+bool operator==(const int& left, const SafeInt& right); >+bool operator!=(const int& left, const SafeInt& right); >+bool operator<(const int& left, const SafeInt& right); >+bool operator<=(const int& left, const SafeInt& right); >+bool operator>(const int& left, const SafeInt& right); >+bool operator>=(const int& left, const SafeInt& right); >+ >+SafeInt operator+(const int& left, const SafeInt& right); >+SafeInt operator-(const int& left, const SafeInt& right); >+SafeInt operator*(const int& left, const SafeInt& right); >+SafeInt operator/(const int& left, const SafeInt& right); >+SafeInt operator%(const int& left, const SafeInt& right); >+#endif >+ >+#ifdef __cplusplus > extern "C" { > #endif > >@@ -105,4 +199,12 @@ extern char *gstrndup(const char *s, siz > } > #endif > >+ >+#ifdef __cplusplus >+extern void *gmallocn(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP; >+extern void *gmallocn_checkoverflow(SafeInt nObjs, SafeInt objSize) GMEM_EXCEP; >+extern void *greallocn(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP; >+extern void *greallocn_checkoverflow(void *p, SafeInt nObjs, SafeInt objSize) GMEM_EXCEP; >+#endif >+ > #endif >Index: poppler-0.12.0/fofi/FoFiTrueType.cc >=================================================================== >--- poppler-0.12.0.orig/fofi/FoFiTrueType.cc >+++ poppler-0.12.0/fofi/FoFiTrueType.cc >@@ -444,7 +444,7 @@ int FoFiTrueType::mapNameToGID(char *nam > return nameToGID->lookupInt(name); > } > >-Gushort *FoFiTrueType::getCIDToGIDMap(int *nCIDs) { >+Gushort *FoFiTrueType::getCIDToGIDMap(SafeInt *nCIDs) { > FoFiType1C *ff; > Gushort *map; > int i; >@@ -552,7 +552,7 @@ void FoFiTrueType::convertToType1(char * > } > > void FoFiTrueType::convertToCIDType2(char *psName, >- Gushort *cidMap, int nCIDs, >+ Gushort *cidMap, SafeInt nCIDs, > GBool needVerticalMetrics, > FoFiOutputFunc outputFunc, > void *outputStream) { >@@ -586,7 +586,7 @@ void FoFiTrueType::convertToCIDType2(cha > (*outputFunc)(outputStream, " end def\n", 10); > (*outputFunc)(outputStream, "/GDBytes 2 def\n", 15); > if (cidMap) { >- buf = GooString::format("/CIDCount {0:d} def\n", nCIDs); >+ buf = GooString::format("/CIDCount {0:d} def\n", nCIDs.Int()); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; > if (nCIDs > 32767) { >@@ -625,13 +625,13 @@ void FoFiTrueType::convertToCIDType2(cha > } > } else { > // direct mapping - just fill the string(s) with s[i]=i >- buf = GooString::format("/CIDCount {0:d} def\n", nGlyphs); >+ buf = GooString::format("/CIDCount {0:d} def\n", nGlyphs.Int()); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; > if (nGlyphs > 32767) { > (*outputFunc)(outputStream, "/CIDMap [\n", 10); > for (i = 0; i < nGlyphs; i += 32767) { >- j = nGlyphs - i < 32767 ? nGlyphs - i : 32767; >+ j = nGlyphs.Int() - i < 32767 ? nGlyphs.Int() - i : 32767; > buf = GooString::format(" {0:d} string 0 1 {1:d} {{\n", 2 * j, j - 1); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; >@@ -647,10 +647,10 @@ void FoFiTrueType::convertToCIDType2(cha > } > (*outputFunc)(outputStream, "] def\n", 6); > } else { >- buf = GooString::format("/CIDMap {0:d} string\n", 2 * nGlyphs); >+ buf = GooString::format("/CIDMap {0:d} string\n", 2 * nGlyphs.Int()); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; >- buf = GooString::format(" 0 1 {0:d} {{\n", nGlyphs - 1); >+ buf = GooString::format(" 0 1 {0:d} {{\n", nGlyphs.Int() - 1); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; > (*outputFunc)(outputStream, >@@ -702,7 +702,7 @@ void FoFiTrueType::convertToCIDType0(cha > delete ff; > } > >-void FoFiTrueType::convertToType0(char *psName, Gushort *cidMap, int nCIDs, >+void FoFiTrueType::convertToType0(char *psName, Gushort *cidMap, SafeInt nCIDs, > GBool needVerticalMetrics, > FoFiOutputFunc outputFunc, > void *outputStream) { >@@ -720,7 +720,7 @@ void FoFiTrueType::convertToType0(char * > delete sfntsName; > > // write the descendant Type 42 fonts >- n = cidMap ? nCIDs : nGlyphs; >+ n = cidMap ? nCIDs.Int() : nGlyphs.Int(); > for (i = 0; i < n; i += 256) { > (*outputFunc)(outputStream, "10 dict begin\n", 14); > (*outputFunc)(outputStream, "/FontName /", 11); >@@ -884,12 +884,13 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > }; > GBool missingCmap, missingName, missingPost, missingOS2; > GBool unsortedLoca, badCmapLen, abbrevHMTX; >- int nZeroLengthTables; >+ SafeInt nZeroLengthTables; > int nHMetrics, advWidth, lsb; > TrueTypeLoca *locaTable; > TrueTypeTable *newTables; > char *newNameTab, *newCmapTab, *newHHEATab, *newHMTXTab; >- int nNewTables, cmapIdx, cmapLen, glyfLen, newNameLen, newCmapLen, next; >+ SafeInt nNewTables; >+ int cmapIdx, cmapLen, glyfLen, newNameLen, newCmapLen, next; > int newHHEALen, newHMTXLen; > Guint locaChecksum, glyfChecksum, fileChecksum; > char *tableDir; >@@ -918,7 +919,7 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > missingOS2 = seekTable("OS/2") < 0; > > // read the loca table, check to see if it's sorted >- locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + 1, sizeof(TrueTypeLoca)); >+ locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + SafeInt(1), sizeof(TrueTypeLoca)); > unsortedLoca = gFalse; > i = seekTable("loca"); > pos = tables[i].offset; >@@ -997,13 +998,13 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > // the same pos value remain in the same order) > glyfLen = 0; // make gcc happy > if (unsortedLoca) { >- qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca), >+ qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca), > &cmpTrueTypeLocaOffset); > for (i = 0; i < nGlyphs; ++i) { > locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset; > } >- locaTable[nGlyphs].len = 0; >- qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca), >+ locaTable[nGlyphs.Int()].len = 0; >+ qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca), > &cmpTrueTypeLocaIdx); > pos = 0; > for (i = 0; i <= nGlyphs; ++i) { >@@ -1046,7 +1047,7 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > // construct the new name table > if (name) { > n = strlen(name); >- newNameLen = (6 + 4*12 + 2 * (3*n + 7) + 3) & ~3; >+ newNameLen = (6 + 4*12 + 2 * (3*SafeInt(n) + 7) + 3).Int() & ~3; > newNameTab = (char *)gmalloc(newNameLen); > memset(newNameTab, 0, newNameLen); > newNameTab[0] = 0; // format selector >@@ -1151,11 +1152,11 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > for (i = 0; i < newHHEALen; ++i) { > newHHEATab[i] = getU8(pos++, &ok); > } >- newHHEATab[34] = nGlyphs >> 8; >- newHHEATab[35] = nGlyphs & 0xff; >+ newHHEATab[34] = nGlyphs.Int() >> 8; >+ newHHEATab[35] = nGlyphs.Int() & 0xff; > i = seekTable("hmtx"); > pos = tables[i].offset; >- newHMTXLen = 4 * nGlyphs; >+ newHMTXLen = (4 * nGlyphs).Int(); > newHMTXTab = (char *)gmalloc(newHMTXLen); > advWidth = 0; > for (i = 0; i < nHMetrics; ++i) { >@@ -1211,7 +1212,7 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > } else if (newTables[j].tag == cmapTag && badCmapLen) { > newTables[j].len = cmapLen; > } else if (newTables[j].tag == locaTag && unsortedLoca) { >- newTables[j].len = (nGlyphs + 1) * (locaFmt ? 4 : 2); >+ newTables[j].len = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2); > newTables[j].checksum = locaChecksum; > } else if (newTables[j].tag == glyfTag && unsortedLoca) { > newTables[j].len = glyfLen; >@@ -1272,9 +1273,9 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > newTables[j].len = sizeof(os2Tab); > ++j; > } >- qsort(newTables, nNewTables, sizeof(TrueTypeTable), >+ qsort(newTables, nNewTables.Int(), sizeof(TrueTypeTable), > &cmpTrueTypeTableTag); >- pos = 12 + nNewTables * 16; >+ pos = 12 + nNewTables.Int() * 16; > for (i = 0; i < nNewTables; ++i) { > newTables[i].offset = pos; > pos += newTables[i].len; >@@ -1284,20 +1285,20 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > } > > // write the table directory >- tableDir = (char *)gmalloc(12 + nNewTables * 16); >+ tableDir = (char *)gmalloc((SafeInt(12) + nNewTables * SafeInt(16)).Int()); > tableDir[0] = 0x00; // sfnt version > tableDir[1] = 0x01; > tableDir[2] = 0x00; > tableDir[3] = 0x00; >- tableDir[4] = (char)((nNewTables >> 8) & 0xff); // numTables >- tableDir[5] = (char)(nNewTables & 0xff); >- for (i = -1, t = (Guint)nNewTables; t; ++i, t >>= 1) ; >+ tableDir[4] = (char)((nNewTables.Int() >> 8) & 0xff); // numTables >+ tableDir[5] = (char)(nNewTables.Int() & 0xff); >+ for (i = -1, t = (Guint)nNewTables.Int(); t; ++i, t >>= 1) ; > t = 1 << (4 + i); > tableDir[6] = (char)((t >> 8) & 0xff); // searchRange > tableDir[7] = (char)(t & 0xff); > tableDir[8] = (char)((i >> 8) & 0xff); // entrySelector > tableDir[9] = (char)(i & 0xff); >- t = nNewTables * 16 - t; >+ t = nNewTables.Int() * 16 - t; > tableDir[10] = (char)((t >> 8) & 0xff); // rangeShift > tableDir[11] = (char)(t & 0xff); > pos = 12; >@@ -1320,11 +1321,11 @@ void FoFiTrueType::writeTTF(FoFiOutputFu > tableDir[pos+15] = (char) newTables[i].len; > pos += 16; > } >- (*outputFunc)(outputStream, tableDir, 12 + nNewTables * 16); >+ (*outputFunc)(outputStream, tableDir, 12 + nNewTables.Int() * 16); > > // compute the file checksum > fileChecksum = computeTableChecksum((Guchar *)tableDir, >- 12 + nNewTables * 16); >+ 12 + nNewTables.Int() * 16); > for (i = 0; i < nNewTables; ++i) { > fileChecksum += newTables[i].checksum; > } >@@ -1512,7 +1513,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > Guchar tableDir[12 + nT42Tables*16]; > GBool ok; > Guint checksum; >- int nNewTables; >+ SafeInt nNewTables; > int length, pos, glyfPos, i, j, k; > Guchar vheaTab[36] = { > 0, 1, 0, 0, // table version number >@@ -1556,7 +1557,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > // table, cmpTrueTypeLocaPos uses offset as its primary sort key, > // and idx as its secondary key (ensuring that adjacent entries with > // the same pos value remain in the same order) >- locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + 1, sizeof(TrueTypeLoca)); >+ locaTable = (TrueTypeLoca *)gmallocn(nGlyphs + SafeInt(1), sizeof(TrueTypeLoca)); > i = seekTable("loca"); > pos = tables[i].offset; > ok = gTrue; >@@ -1568,13 +1569,13 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > locaTable[i].origOffset = 2 * getU16BE(pos + i*2, &ok); > } > } >- qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca), >+ qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca), > &cmpTrueTypeLocaOffset); > for (i = 0; i < nGlyphs; ++i) { > locaTable[i].len = locaTable[i+1].origOffset - locaTable[i].origOffset; > } >- locaTable[nGlyphs].len = 0; >- qsort(locaTable, nGlyphs + 1, sizeof(TrueTypeLoca), >+ locaTable[nGlyphs.Int()].len = 0; >+ qsort(locaTable, nGlyphs.Int() + 1, sizeof(TrueTypeLoca), > &cmpTrueTypeLocaIdx); > pos = 0; > for (i = 0; i <= nGlyphs; ++i) { >@@ -1586,7 +1587,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > } > > // construct the new 'loca' table >- locaData = (Guchar *)gmallocn(nGlyphs + 1, (locaFmt ? 4 : 2)); >+ locaData = (Guchar *)gmallocn(nGlyphs + SafeInt(1), (locaFmt ? 4 : 2)); > for (i = 0; i <= nGlyphs; ++i) { > pos = locaTable[i].newOffset; > if (locaFmt) { >@@ -1627,7 +1628,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > > // construct the new table headers, including table checksums > // (pad each table out to a multiple of 4 bytes) >- pos = 12 + nNewTables*16; >+ pos = 12 + nNewTables.Int()*16; > k = 0; > for (i = 0; i < nT42Tables; ++i) { > length = -1; >@@ -1636,7 +1637,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > length = 54; > checksum = computeTableChecksum(headData, 54); > } else if (i == t42LocaTable) { >- length = (nGlyphs + 1) * (locaFmt ? 4 : 2); >+ length = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2); > checksum = computeTableChecksum(locaData, length); > } else if (i == t42GlyfTable) { > length = 0; >@@ -1665,7 +1666,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > length = sizeof(vheaTab); > checksum = computeTableChecksum(vheaTab, length); > } else if (needVerticalMetrics && i == t42VmtxTable) { >- length = 4 + (nGlyphs - 1) * 4; >+ length = (4 + (nGlyphs - 1) * 4).Int(); > vmtxTab = (Guchar *)gmalloc(length); > vmtxTab[0] = advance / 256; > vmtxTab[1] = advance % 256; >@@ -1703,13 +1704,13 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > tableDir[2] = 0x00; > tableDir[3] = 0x00; > tableDir[4] = 0; // numTables >- tableDir[5] = nNewTables; >+ tableDir[5] = nNewTables.Int(); > tableDir[6] = 0; // searchRange > tableDir[7] = (Guchar)128; > tableDir[8] = 0; // entrySelector > tableDir[9] = 3; > tableDir[10] = 0; // rangeShift >- tableDir[11] = (Guchar)(16 * nNewTables - 128); >+ tableDir[11] = (Guchar)(16 * nNewTables.Int() - 128); > pos = 12; > for (i = 0; i < nNewTables; ++i) { > tableDir[pos ] = (Guchar)(newTables[i].tag >> 24); >@@ -1732,7 +1733,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > } > > // compute the font checksum and store it in the head table >- checksum = computeTableChecksum(tableDir, 12 + nNewTables*16); >+ checksum = computeTableChecksum(tableDir, 12 + nNewTables.Int()*16); > for (i = 0; i < nNewTables; ++i) { > checksum += newTables[i].checksum; > } >@@ -1752,14 +1753,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFu > } > > // write the table directory >- dumpString(tableDir, 12 + nNewTables*16, outputFunc, outputStream); >+ dumpString(tableDir, 12 + nNewTables.Int()*16, outputFunc, outputStream); > > // write the tables > for (i = 0; i < nNewTables; ++i) { > if (i == t42HeadTable) { > dumpString(headData, 54, outputFunc, outputStream); > } else if (i == t42LocaTable) { >- length = (nGlyphs + 1) * (locaFmt ? 4 : 2); >+ length = (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2); > dumpString(locaData, length, outputFunc, outputStream); > } else if (i == t42GlyfTable) { > glyfPos = tables[seekTable("glyf")].offset; >@@ -1983,7 +1984,7 @@ void FoFiTrueType::parse() { > parsedOk = gFalse; > return; > } >- if (tables[i].len < (nGlyphs + 1) * (locaFmt ? 4 : 2)) { >+ if (tables[i].len < (nGlyphs.Int() + 1) * (locaFmt ? 4 : 2)) { > nGlyphs = tables[i].len / (locaFmt ? 4 : 2) - 1; > } > for (j = 0; j <= nGlyphs; ++j) { >@@ -2032,7 +2033,7 @@ void FoFiTrueType::readPostTable() { > goto err; > } > if (n > nGlyphs) { >- n = nGlyphs; >+ n = nGlyphs.Int(); > } > stringIdx = 0; > stringPos = tablePos + 34 + 2*n; >Index: poppler-0.12.0/fofi/FoFiTrueType.h >=================================================================== >--- poppler-0.12.0.orig/fofi/FoFiTrueType.h >+++ poppler-0.12.0/fofi/FoFiTrueType.h >@@ -83,7 +83,7 @@ public: > // Return the mapping from CIDs to GIDs, and return the number of > // CIDs in *<nCIDs>. This is only useful for CID fonts. (Only > // useful for OpenType CFF fonts.) >- Gushort *getCIDToGIDMap(int *nCIDs); >+ Gushort *getCIDToGIDMap(SafeInt *nCIDs); > > // Returns the least restrictive embedding licensing right (as > // defined by the TrueType spec): >@@ -120,7 +120,7 @@ public: > // name (so we don't need to depend on the 'name' table in the > // font). The <cidMap> array maps CIDs to GIDs; it has <nCIDs> > // entries. (Not useful for OpenType CFF fonts.) >- void convertToCIDType2(char *psName, Gushort *cidMap, int nCIDs, >+ void convertToCIDType2(char *psName, Gushort *cidMap, SafeInt nCIDs, > GBool needVerticalMetrics, > FoFiOutputFunc outputFunc, void *outputStream); > >@@ -135,7 +135,7 @@ public: > // PostScript font name (so we don't need to depend on the 'name' > // table in the font). The <cidMap> array maps CIDs to GIDs; it has > // <nCIDs> entries. (Not useful for OpenType CFF fonts.) >- void convertToType0(char *psName, Gushort *cidMap, int nCIDs, >+ void convertToType0(char *psName, Gushort *cidMap, SafeInt nCIDs, > GBool needVerticalMetrics, > FoFiOutputFunc outputFunc, void *outputStream); > >@@ -182,10 +182,10 @@ private: > int checkGIDInCoverage(Guint coverage, Guint orgGID); > > TrueTypeTable *tables; >- int nTables; >+ SafeInt nTables; > TrueTypeCmap *cmaps; > int nCmaps; >- int nGlyphs; >+ SafeInt nGlyphs; > int locaFmt; > int bbox[4]; > GooHash *nameToGID; >Index: poppler-0.12.0/fofi/FoFiType1C.cc >=================================================================== >--- poppler-0.12.0.orig/fofi/FoFiType1C.cc >+++ poppler-0.12.0/fofi/FoFiType1C.cc >@@ -116,9 +116,10 @@ char **FoFiType1C::getEncoding() { > return encoding; > } > >-Gushort *FoFiType1C::getCIDToGIDMap(int *nCIDs) { >+Gushort *FoFiType1C::getCIDToGIDMap(SafeInt *nCIDs) { > Gushort *map; >- int n, i; >+ SafeInt n; >+ int i; > > // a CID font's top dict has ROS as the first operator > if (topDict.firstOp != 0x0c1e) { >@@ -136,7 +137,7 @@ Gushort *FoFiType1C::getCIDToGIDMap(int > } > ++n; > map = (Gushort *)gmallocn(n, sizeof(Gushort)); >- memset(map, 0, n * sizeof(Gushort)); >+ memset(map, 0, n.Int() * sizeof(Gushort)); > for (i = 0; i < nGlyphs; ++i) { > map[charset[i]] = i; > } >@@ -452,7 +453,8 @@ void FoFiType1C::convertToCIDType0(char > int *charStringOffsets; > Type1CIndex subrIdx; > Type1CIndexVal val; >- int nCIDs, gdBytes; >+ SafeInt nCIDs; >+ int gdBytes; > GooString *buf; > char buf2[256]; > GBool ok; >@@ -475,7 +477,7 @@ void FoFiType1C::convertToCIDType0(char > > // build the charstrings > charStrings = new GooString(); >- charStringOffsets = (int *)gmallocn(nCIDs + 1, sizeof(int)); >+ charStringOffsets = (int *)gmallocn(nCIDs + SafeInt(1), sizeof(int)); > for (i = 0; i < nCIDs; ++i) { > charStringOffsets[i] = charStrings->getLength(); > if ((gid = cidMap[i]) >= 0) { >@@ -491,13 +493,13 @@ void FoFiType1C::convertToCIDType0(char > } > } > } >- charStringOffsets[nCIDs] = charStrings->getLength(); >+ charStringOffsets[nCIDs.Int()] = charStrings->getLength(); > > // compute gdBytes = number of bytes needed for charstring offsets > // (offset size needs to account for the charstring offset table, > // with a worst case of five bytes per entry, plus the charstrings > // themselves) >- i = (nCIDs + 1) * 5 + charStrings->getLength(); >+ i = (nCIDs.Int() + 1) * 5 + charStrings->getLength(); > if (i < 0x100) { > gdBytes = 1; > } else if (i < 0x10000) { >@@ -562,7 +564,7 @@ void FoFiType1C::convertToCIDType0(char > (*outputFunc)(outputStream, "end def\n", 8); > > // CIDFont-specific entries >- buf = GooString::format("/CIDCount {0:d} def\n", nCIDs); >+ buf = GooString::format("/CIDCount {0:d} def\n", nCIDs.Int()); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; > (*outputFunc)(outputStream, "/FDBytes 1 def\n", 15); >@@ -580,7 +582,7 @@ void FoFiType1C::convertToCIDType0(char > } > > // FDArray entry >- buf = GooString::format("/FDArray {0:d} array\n", nFDs); >+ buf = GooString::format("/FDArray {0:d} array\n", nFDs.Int()); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); > delete buf; > for (i = 0; i < nFDs; ++i) { >@@ -723,7 +725,7 @@ void FoFiType1C::convertToCIDType0(char > (*outputFunc)(outputStream, "def\n", 4); > > // start the binary section >- offset = (nCIDs + 1) * (1 + gdBytes); >+ offset = (nCIDs.Int() + 1) * (1 + gdBytes); > buf = GooString::format("(Hex) {0:d} StartData\n", > offset + charStrings->getLength()); > (*outputFunc)(outputStream, buf->getCString(), buf->getLength()); >@@ -776,7 +778,7 @@ void FoFiType1C::convertToType0(char *ps > int *cidMap; > Type1CIndex subrIdx; > Type1CIndexVal val; >- int nCIDs; >+ SafeInt nCIDs; > GooString *buf; > Type1CEexecBuf eb; > GBool ok; >Index: poppler-0.12.0/fofi/FoFiType1C.h >=================================================================== >--- poppler-0.12.0.orig/fofi/FoFiType1C.h >+++ poppler-0.12.0/fofi/FoFiType1C.h >@@ -163,7 +163,7 @@ public: > > // Return the mapping from CIDs to GIDs, and return the number of > // CIDs in *<nCIDs>. This is only useful for CID fonts. >- Gushort *getCIDToGIDMap(int *nCIDs); >+ Gushort *getCIDToGIDMap(SafeInt *nCIDs); > > // Convert to a Type 1 font, suitable for embedding in a PostScript > // file. This is only useful with 8-bit fonts. If <newEncoding> is >@@ -228,7 +228,7 @@ private: > Type1CPrivateDict *privateDicts; > > int nGlyphs; >- int nFDs; >+ SafeInt nFDs; > Guchar *fdSelect; > Gushort *charset; > int gsubrBias; >Index: poppler-0.12.0/goo/GooHash.cc >=================================================================== >--- poppler-0.12.0.orig/goo/GooHash.cc >+++ poppler-0.12.0/goo/GooHash.cc >@@ -311,7 +311,8 @@ void GooHash::killIter(GooHashIter **ite > void GooHash::expand() { > GooHashBucket **oldTab; > GooHashBucket *p; >- int oldSize, h, i; >+ int h, i; >+ SafeInt oldSize; > > oldSize = size; > oldTab = tab; >@@ -365,7 +366,7 @@ int GooHash::hash(GooString *key) { > for (p = key->getCString(), i = 0; i < key->getLength(); ++p, ++i) { > h = 17 * h + (int)(*p & 0xff); > } >- return (int)(h % size); >+ return (int)(h % size.Int()); > } > > int GooHash::hash(char *key) { >@@ -376,5 +377,5 @@ int GooHash::hash(char *key) { > for (p = key; *p; ++p) { > h = 17 * h + (int)(*p & 0xff); > } >- return (int)(h % size); >+ return (int)(h % size.Int()); > } >Index: poppler-0.12.0/goo/GooHash.h >=================================================================== >--- poppler-0.12.0.orig/goo/GooHash.h >+++ poppler-0.12.0/goo/GooHash.h >@@ -53,7 +53,7 @@ private: > int hash(char *key); > > GBool deleteKeys; // set if key strings should be deleted >- int size; // number of buckets >+ SafeInt size; // number of buckets > int len; // number of entries > GooHashBucket **tab; > }; >Index: poppler-0.12.0/goo/GooList.cc >=================================================================== >--- poppler-0.12.0.orig/goo/GooList.cc >+++ poppler-0.12.0/goo/GooList.cc >@@ -43,7 +43,7 @@ void GooList::append(void *p) { > if (length >= size) { > expand(); > } >- data[length++] = p; >+ data[(length++).Int()] = p; > } > > void GooList::append(GooList *list) { >@@ -53,7 +53,7 @@ void GooList::append(GooList *list) { > expand(); > } > for (i = 0; i < list->length; ++i) { >- data[length++] = list->data[i]; >+ data[(length++).Int()] = list->data[i]; > } > } > >@@ -62,7 +62,7 @@ void GooList::insert(int i, void *p) { > expand(); > } > if (i < length) { >- memmove(data+i+1, data+i, (length - i) * sizeof(void *)); >+ memmove(data+i+1, data+i, (length.Int() - i) * sizeof(void *)); > } > data[i] = p; > ++length; >@@ -73,7 +73,7 @@ void *GooList::del(int i) { > > p = data[i]; > if (i < length - 1) { >- memmove(data+i, data+i+1, (length - i - 1) * sizeof(void *)); >+ memmove(data+i, data+i+1, (length.Int() - i - 1) * sizeof(void *)); > } > --length; > if (size - length >= ((inc > 0) ? inc : size/2)) { >@@ -83,7 +83,7 @@ void *GooList::del(int i) { > } > > void GooList::sort(int (*cmp)(const void *obj1, const void *obj2)) { >- qsort(data, length, sizeof(void *), cmp); >+ qsort(data, length.Int(), sizeof(void *), cmp); > } > > void GooList::expand() { >Index: poppler-0.12.0/goo/GooList.h >=================================================================== >--- poppler-0.12.0.orig/goo/GooList.h >+++ poppler-0.12.0/goo/GooList.h >@@ -14,6 +14,7 @@ > #endif > > #include "gtypes.h" >+#include "gmem.h" > > //------------------------------------------------------------------------ > // GooList >@@ -34,7 +35,7 @@ public: > //----- general > > // Get the number of elements. >- int getLength() { return length; } >+ int getLength() { return length.Int(); } > > //----- ordered list support > >@@ -74,9 +75,9 @@ private: > void shrink(); > > void **data; // the list elements >- int size; // size of data array >- int length; // number of elements on list >- int inc; // allocation increment >+ SafeInt size; // size of data array >+ SafeInt length; // number of elements on list >+ SafeInt inc; // allocation increment > }; > > #define deleteGooList(list, T) \ >Index: poppler-0.12.0/goo/GooString.cc >=================================================================== >--- poppler-0.12.0.orig/goo/GooString.cc >+++ poppler-0.12.0/goo/GooString.cc >@@ -274,7 +274,8 @@ GooString *GooString::appendf(char *fmt, > > GooString *GooString::appendfv(char *fmt, va_list argList) { > GooStringFormatArg *args; >- int argsLen, argsSize; >+ int argsLen; >+ SafeInt argsSize; > GooStringFormatArg arg; > int idx, width, prec; > GBool reverseAlign, zeroFill; >Index: poppler-0.12.0/splash/Splash.cc >=================================================================== >--- poppler-0.12.0.orig/splash/Splash.cc >+++ poppler-0.12.0/splash/Splash.cc >@@ -2005,7 +2005,7 @@ SplashError Splash::fillImageMask(Splash > if (yp < 0 || yp > INT_MAX - 1) { > return splashErrBadArg; > } >- pixBuf = (SplashColorPtr)gmallocn((yp + 1), w); >+ pixBuf = (SplashColorPtr)gmallocn((SafeInt(yp) + SafeInt(1)), SafeInt(w)); > > // initialize the pixel pipe > pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha, >@@ -2310,7 +2310,7 @@ SplashError Splash::drawImage(SplashImag > } > colorBuf = (SplashColorPtr)gmallocn3((yp + 1), w, nComps); > if (srcAlpha) { >- alphaBuf = (Guchar *)gmallocn((yp + 1), w); >+ alphaBuf = (Guchar *)gmalloc(((SafeInt(yp) + SafeInt(1)) * SafeInt(w)).Int()); > } else { > alphaBuf = NULL; > } >@@ -3327,7 +3327,7 @@ SplashPath *Splash::makeStrokePath(Splas > // draw the start cap > pathOut->moveTo(pathIn->pts[i].x - wdy, pathIn->pts[i].y + wdx); > if (i == subpathStart) { >- firstPt = pathOut->length - 1; >+ firstPt = pathOut->length.Int() - 1; > } > if (first && !closed) { > switch (state->lineCap) { >@@ -3362,7 +3362,7 @@ SplashPath *Splash::makeStrokePath(Splas > } > > // draw the left side of the segment rectangle >- left2 = pathOut->length - 1; >+ left2 = pathOut->length.Int() - 1; > pathOut->lineTo(pathIn->pts[i+1].x + wdy, pathIn->pts[i+1].y - wdx); > > // draw the end cap >@@ -3399,11 +3399,11 @@ SplashPath *Splash::makeStrokePath(Splas > } > > // draw the right side of the segment rectangle >- right2 = pathOut->length - 1; >+ right2 = pathOut->length.Int() - 1; > pathOut->close(); > > // draw the join >- join2 = pathOut->length; >+ join2 = pathOut->length.Int(); > if (!last || closed) { > crossprod = dx * dyNext - dy * dxNext; > dotprod = -(dx * dxNext + dy * dyNext); >@@ -3517,10 +3517,10 @@ SplashPath *Splash::makeStrokePath(Splas > if (i >= subpathStart + 2) { > pathOut->addStrokeAdjustHint(left1, right1, left0 + 1, right0); > pathOut->addStrokeAdjustHint(left1, right1, >- join0, pathOut->length - 1); >+ join0, pathOut->length.Int() - 1); > } else { > pathOut->addStrokeAdjustHint(left1, right1, >- firstPt, pathOut->length - 1); >+ firstPt, pathOut->length.Int() - 1); > } > if (closed) { > pathOut->addStrokeAdjustHint(left1, right1, firstPt, leftFirst); >@@ -3529,7 +3529,7 @@ SplashPath *Splash::makeStrokePath(Splas > pathOut->addStrokeAdjustHint(leftFirst, rightFirst, > left1 + 1, right1); > pathOut->addStrokeAdjustHint(leftFirst, rightFirst, >- join1, pathOut->length - 1); >+ join1, pathOut->length.Int() - 1); > } > } > } >Index: poppler-0.12.0/splash/SplashPath.h >=================================================================== >--- poppler-0.12.0.orig/splash/SplashPath.h >+++ poppler-0.12.0/splash/SplashPath.h >@@ -89,7 +89,7 @@ public: > void offset(SplashCoord dx, SplashCoord dy); > > // Get the points on the path. >- int getLength() { return length; } >+ int getLength() { return length.Int(); } > void getPoint(int i, double *x, double *y, Guchar *f) > { *x = pts[i].x; *y = pts[i].y; *f = flags[i]; } > >@@ -106,11 +106,11 @@ protected: > > SplashPathPoint *pts; // array of points > Guchar *flags; // array of flags >- int length, size; // length/size of the pts and flags arrays >+ SafeInt length, size; // length/size of the pts and flags arrays > int curSubpath; // index of first point in last subpath > > SplashPathHint *hints; // list of hints >- int hintsLength, hintsSize; >+ SafeInt hintsLength, hintsSize; > > friend class SplashXPath; > friend class Splash; >Index: poppler-0.12.0/splash/SplashClip.h >=================================================================== >--- poppler-0.12.0.orig/splash/SplashClip.h >+++ poppler-0.12.0/splash/SplashClip.h >@@ -99,7 +99,8 @@ protected: > SplashXPath **paths; > Guchar *flags; > SplashXPathScanner **scanners; >- int length, size; >+ int length; >+ SafeInt size; > }; > > #endif >Index: poppler-0.12.0/splash/SplashClip.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashClip.cc >+++ poppler-0.12.0/splash/SplashClip.cc >@@ -55,7 +55,8 @@ SplashClip::SplashClip(SplashCoord x0, S > paths = NULL; > flags = NULL; > scanners = NULL; >- length = size = 0; >+ length = 0; >+ size = 0; > } > > SplashClip::SplashClip(SplashClip *clip) { >@@ -124,7 +125,8 @@ void SplashClip::resetToRect(SplashCoord > paths = NULL; > flags = NULL; > scanners = NULL; >- length = size = 0; >+ length = 0; >+ size = 0; > > if (x0 < x1) { > xMin = x0; >Index: poppler-0.12.0/splash/SplashFTFont.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashFTFont.cc >+++ poppler-0.12.0/splash/SplashFTFont.cc >@@ -180,7 +180,7 @@ GBool SplashFTFont::makeGlyph(int c, int > FT_Vector offset; > FT_GlyphSlot slot; > FT_UInt gid; >- int rowSize; >+ SafeInt rowSize; > Guchar *p, *q; > int i; > >@@ -235,14 +235,14 @@ GBool SplashFTFont::makeGlyph(int c, int > if (aa) { > rowSize = bitmap->w; > } else { >- rowSize = (bitmap->w + 7) >> 3; >+ rowSize = (SafeInt(bitmap->w) + SafeInt(7)) >> 3; > } > bitmap->data = (Guchar *)gmallocn_checkoverflow(rowSize, bitmap->h); > bitmap->freeData = gTrue; > for (i = 0, p = bitmap->data, q = slot->bitmap.buffer; > i < bitmap->h; >- ++i, p += rowSize, q += slot->bitmap.pitch) { >- memcpy(p, q, rowSize); >+ ++i, p += rowSize.Int(), q += slot->bitmap.pitch) { >+ memcpy(p, q, rowSize.Int()); > } > > return gTrue; >Index: poppler-0.12.0/splash/SplashFTFontEngine.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashFTFontEngine.cc >+++ poppler-0.12.0/splash/SplashFTFontEngine.cc >@@ -106,7 +106,7 @@ SplashFontFile *SplashFTFontEngine::load > SplashFontSrc *src) { > FoFiType1C *ff; > Gushort *cidToGIDMap; >- int nCIDs; >+ SafeInt nCIDs; > SplashFontFile *ret; > > // check for a CFF font >@@ -127,7 +127,7 @@ SplashFontFile *SplashFTFontEngine::load > nCIDs = 0; > } > } >- ret = SplashFTFontFile::loadCIDFont(this, idA, src, cidToGIDMap, nCIDs); >+ ret = SplashFTFontFile::loadCIDFont(this, idA, src, cidToGIDMap, nCIDs.Int()); > if (!ret) { > gfree(cidToGIDMap); > } >@@ -139,7 +139,7 @@ SplashFontFile *SplashFTFontEngine::load > FoFiTrueType *ff; > GBool isCID; > Gushort *cidToGIDMap; >- int nCIDs; >+ SafeInt nCIDs; > SplashFontFile *ret; > > cidToGIDMap = NULL; >@@ -159,7 +159,7 @@ SplashFontFile *SplashFTFontEngine::load > } > } > ret = SplashFTFontFile::loadCIDFont(this, idA, src, >- cidToGIDMap, nCIDs); >+ cidToGIDMap, nCIDs.Int()); > if (!ret) { > gfree(cidToGIDMap); > } >Index: poppler-0.12.0/splash/SplashFont.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashFont.cc >+++ poppler-0.12.0/splash/SplashFont.cc >@@ -93,7 +93,7 @@ void SplashFont::initCache() { > cacheTags = (SplashFontCacheTag *)gmallocn(cacheSets * cacheAssoc, > sizeof(SplashFontCacheTag)); > for (i = 0; i < cacheSets * cacheAssoc; ++i) { >- cacheTags[i].mru = i & (cacheAssoc - 1); >+ cacheTags[i].mru = i & (cacheAssoc.Int() - 1); > } > } else { > cacheAssoc = 0; >@@ -124,7 +124,7 @@ GBool SplashFont::getGlyph(int c, int xF > } > > // check the cache >- i = (c & (cacheSets - 1)) * cacheAssoc; >+ i = (c & (cacheSets.Int() - 1)) * cacheAssoc.Int(); > for (j = 0; j < cacheAssoc; ++j) { > if ((cacheTags[i+j].mru & 0x80000000) && > cacheTags[i+j].c == c && >@@ -189,7 +189,7 @@ GBool SplashFont::getGlyph(int c, int xF > else > { > for (j = 0; j < cacheAssoc; ++j) { >- if ((cacheTags[i+j].mru & 0x7fffffff) == cacheAssoc - 1) { >+ if ((cacheTags[i+j].mru & 0x7fffffff) == cacheAssoc.Int() - 1) { > cacheTags[i+j].mru = 0x80000000; > cacheTags[i+j].c = c; > cacheTags[i+j].xFrac = (short)xFrac; >Index: poppler-0.12.0/splash/SplashFont.h >=================================================================== >--- poppler-0.12.0.orig/splash/SplashFont.h >+++ poppler-0.12.0/splash/SplashFont.h >@@ -114,8 +114,8 @@ protected: > cacheTags; > int glyphW, glyphH; // size of glyph bitmaps > int glyphSize; // size of glyph bitmaps, in bytes >- int cacheSets; // number of sets in cache >- int cacheAssoc; // cache associativity (glyphs per set) >+ SafeInt cacheSets; // number of sets in cache >+ SafeInt cacheAssoc; // cache associativity (glyphs per set) > }; > > #endif >Index: poppler-0.12.0/splash/SplashPath.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashPath.cc >+++ poppler-0.12.0/splash/SplashPath.cc >@@ -44,13 +44,13 @@ SplashPath::SplashPath(SplashPath *path) > size = path->size; > pts = (SplashPathPoint *)gmallocn(size, sizeof(SplashPathPoint)); > flags = (Guchar *)gmallocn(size, sizeof(Guchar)); >- memcpy(pts, path->pts, length * sizeof(SplashPathPoint)); >- memcpy(flags, path->flags, length * sizeof(Guchar)); >+ memcpy(pts, path->pts, length.Int() * sizeof(SplashPathPoint)); >+ memcpy(flags, path->flags, length.Int() * sizeof(Guchar)); > curSubpath = path->curSubpath; > if (path->hints) { > hintsLength = hintsSize = path->hintsLength; > hints = (SplashPathHint *)gmallocn(hintsSize, sizeof(SplashPathHint)); >- memcpy(hints, path->hints, hintsLength * sizeof(SplashPathHint)); >+ memcpy(hints, path->hints, hintsLength.Int() * sizeof(SplashPathHint)); > } else { > hints = NULL; > } >@@ -79,11 +79,11 @@ void SplashPath::grow(int nPts) { > void SplashPath::append(SplashPath *path) { > int i; > >- curSubpath = length + path->curSubpath; >- grow(path->length); >+ curSubpath = length.Int() + path->curSubpath; >+ grow(path->length.Int()); > for (i = 0; i < path->length; ++i) { >- pts[length] = path->pts[i]; >- flags[length] = path->flags[i]; >+ pts[length.Int()] = path->pts[i]; >+ flags[length.Int()] = path->flags[i]; > ++length; > } > } >@@ -93,10 +93,10 @@ SplashError SplashPath::moveTo(SplashCoo > return splashErrBogusPath; > } > grow(1); >- pts[length].x = x; >- pts[length].y = y; >- flags[length] = splashPathFirst | splashPathLast; >- curSubpath = length++; >+ pts[length.Int()].x = x; >+ pts[length.Int()].y = y; >+ flags[length.Int()] = splashPathFirst | splashPathLast; >+ curSubpath = (length++).Int(); > return splashOk; > } > >@@ -104,11 +104,11 @@ SplashError SplashPath::lineTo(SplashCoo > if (noCurrentPoint()) { > return splashErrNoCurPt; > } >- flags[length-1] &= ~splashPathLast; >+ flags[(length-1).Int()] &= ~splashPathLast; > grow(1); >- pts[length].x = x; >- pts[length].y = y; >- flags[length] = splashPathLast; >+ pts[length.Int()].x = x; >+ pts[length.Int()].y = y; >+ flags[length.Int()] = splashPathLast; > ++length; > return splashOk; > } >@@ -119,19 +119,19 @@ SplashError SplashPath::curveTo(SplashCo > if (noCurrentPoint()) { > return splashErrNoCurPt; > } >- flags[length-1] &= ~splashPathLast; >+ flags[(length-1).Int()] &= ~splashPathLast; > grow(3); >- pts[length].x = x1; >- pts[length].y = y1; >- flags[length] = splashPathCurve; >+ pts[length.Int()].x = x1; >+ pts[length.Int()].y = y1; >+ flags[length.Int()] = splashPathCurve; > ++length; >- pts[length].x = x2; >- pts[length].y = y2; >- flags[length] = splashPathCurve; >+ pts[length.Int()].x = x2; >+ pts[length.Int()].y = y2; >+ flags[length.Int()] = splashPathCurve; > ++length; >- pts[length].x = x3; >- pts[length].y = y3; >- flags[length] = splashPathLast; >+ pts[length.Int()].x = x3; >+ pts[length.Int()].y = y3; >+ flags[length.Int()] = splashPathLast; > ++length; > return splashOk; > } >@@ -140,28 +140,28 @@ SplashError SplashPath::close() { > if (noCurrentPoint()) { > return splashErrNoCurPt; > } >- if (curSubpath == length - 1 || >- pts[length - 1].x != pts[curSubpath].x || >- pts[length - 1].y != pts[curSubpath].y) { >+ if (curSubpath == length.Int() - 1 || >+ pts[length.Int() - 1].x != pts[curSubpath].x || >+ pts[length.Int() - 1].y != pts[curSubpath].y) { > lineTo(pts[curSubpath].x, pts[curSubpath].y); > } > flags[curSubpath] |= splashPathClosed; >- flags[length - 1] |= splashPathClosed; >- curSubpath = length; >+ flags[length.Int() - 1] |= splashPathClosed; >+ curSubpath = length.Int(); > return splashOk; > } > > void SplashPath::addStrokeAdjustHint(int ctrl0, int ctrl1, > int firstPt, int lastPt) { > if (hintsLength == hintsSize) { >- hintsSize = hintsLength ? 2 * hintsLength : 8; >+ hintsSize = hintsLength.Int() ? 2 * hintsLength : 8; > hints = (SplashPathHint *)greallocn(hints, hintsSize, > sizeof(SplashPathHint)); > } >- hints[hintsLength].ctrl0 = ctrl0; >- hints[hintsLength].ctrl1 = ctrl1; >- hints[hintsLength].firstPt = firstPt; >- hints[hintsLength].lastPt = lastPt; >+ hints[hintsLength.Int()].ctrl0 = ctrl0; >+ hints[hintsLength.Int()].ctrl1 = ctrl1; >+ hints[hintsLength.Int()].firstPt = firstPt; >+ hints[hintsLength.Int()].lastPt = lastPt; > ++hintsLength; > } > >@@ -178,7 +178,7 @@ GBool SplashPath::getCurPt(SplashCoord * > if (noCurrentPoint()) { > return gFalse; > } >- *x = pts[length - 1].x; >- *y = pts[length - 1].y; >+ *x = pts[length.Int() - 1].x; >+ *y = pts[length.Int() - 1].y; > return gTrue; > } >Index: poppler-0.12.0/splash/SplashScreen.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashScreen.cc >+++ poppler-0.12.0/splash/SplashScreen.cc >@@ -59,7 +59,7 @@ SplashScreen::SplashScreen(SplashScreenP > // size must be a power of 2 > for (size = 1; size < params->size; size <<= 1) ; > mat = (Guchar *)gmallocn(size * size, sizeof(Guchar)); >- buildDispersedMatrix(size/2, size/2, 1, size/2, 1); >+ buildDispersedMatrix((size/2).Int(), (size/2).Int(), 1, (size/2).Int(), 1); > break; > > case splashScreenClustered: >@@ -74,8 +74,8 @@ SplashScreen::SplashScreen(SplashScreenP > > case splashScreenStochasticClustered: > // size must be at least 2*r >- if (params->size < 2 * params->dotRadius) { >- size = 2 * params->dotRadius; >+ if (SafeInt(params->size) < 2 * SafeInt(params->dotRadius)) { >+ size = 2 * SafeInt(params->dotRadius); > } else { > size = params->size; > } >@@ -118,15 +118,15 @@ void SplashScreen::buildDispersedMatrix( > int delta, int offset) { > if (delta == 0) { > // map values in [1, size^2] --> [1, 255] >- mat[i * size + j] = 1 + (254 * (val - 1)) / (size * size - 1); >+ mat[i * size.Int() + j] = 1 + (254 * (val - 1)) / (size.Int() * size.Int() - 1); > } else { > buildDispersedMatrix(i, j, > val, delta / 2, 4*offset); >- buildDispersedMatrix((i + delta) % size, (j + delta) % size, >+ buildDispersedMatrix((i + delta) % size.Int(), (j + delta) % size.Int(), > val + offset, delta / 2, 4*offset); >- buildDispersedMatrix((i + delta) % size, j, >+ buildDispersedMatrix((i + delta) % size.Int(), j, > val + 2*offset, delta / 2, 4*offset); >- buildDispersedMatrix((i + 2*delta) % size, (j + delta) % size, >+ buildDispersedMatrix((i + 2*delta) % size.Int(), (j + delta) % size.Int(), > val + 3*offset, delta / 2, 4*offset); > } > } >@@ -135,14 +135,15 @@ void SplashScreen::buildClusteredMatrix( > SplashCoord *dist; > SplashCoord u, v, d; > Guchar val; >- int size2, x, y, x1, y1, i; >+ SafeInt size2; >+ int x, y, x1, y1, i; > > size2 = size >> 1; > > // initialize the threshold matrix > for (y = 0; y < size; ++y) { > for (x = 0; x < size; ++x) { >- mat[y * size + x] = 0; >+ mat[y * size.Int() + x] = 0; > } > } > >@@ -154,22 +155,22 @@ void SplashScreen::buildClusteredMatrix( > u = (SplashCoord)x + 0.5 - 0; > v = (SplashCoord)y + 0.5 - 0; > } else { >- u = (SplashCoord)x + 0.5 - (SplashCoord)size2; >- v = (SplashCoord)y + 0.5 - (SplashCoord)size2; >+ u = (SplashCoord)x + 0.5 - (SplashCoord)size2.Int(); >+ v = (SplashCoord)y + 0.5 - (SplashCoord)size2.Int(); > } >- dist[y * size2 + x] = u*u + v*v; >+ dist[y * size2.Int() + x] = u*u + v*v; > } > } > for (y = 0; y < size2; ++y) { > for (x = 0; x < size2; ++x) { > if (x < y) { > u = (SplashCoord)x + 0.5 - 0; >- v = (SplashCoord)y + 0.5 - (SplashCoord)size2; >+ v = (SplashCoord)y + 0.5 - (SplashCoord)size2.Int(); > } else { >- u = (SplashCoord)x + 0.5 - (SplashCoord)size2; >+ u = (SplashCoord)x + 0.5 - (SplashCoord)size2.Int(); > v = (SplashCoord)y + 0.5 - 0; > } >- dist[(size2 + y) * size2 + x] = u*u + v*v; >+ dist[(size2.Int() + y) * size2.Int() + x] = u*u + v*v; > } > } > >@@ -181,22 +182,22 @@ void SplashScreen::buildClusteredMatrix( > d = -1; > for (y = 0; y < size; ++y) { > for (x = 0; x < size2; ++x) { >- if (mat[y * size + x] == 0 && >- dist[y * size2 + x] > d) { >+ if (mat[y * size.Int() + x] == 0 && >+ dist[y * size2.Int() + x] > d) { > x1 = x; > y1 = y; >- d = dist[y1 * size2 + x1]; >+ d = dist[y1 * size2.Int() + x1]; > } > } > } > // map values in [0, 2*size*size2-1] --> [1, 255] >- val = 1 + (254 * (2*i)) / (2*size*size2 - 1); >- mat[y1 * size + x1] = val; >- val = 1 + (254 * (2*i+1)) / (2*size*size2 - 1); >- if (y1 < size2) { >- mat[(y1 + size2) * size + x1 + size2] = val; >+ val = 1 + (254 * (2*i)) / (2*size.Int()*size2.Int() - 1); >+ mat[y1 * size.Int() + x1] = val; >+ val = 1 + (254 * (2*i+1)) / (2*size.Int()*size2.Int() - 1); >+ if (y1 < size2.Int()) { >+ mat[(y1 + size2.Int()) * size.Int() + x1 + size2.Int()] = val; > } else { >- mat[(y1 - size2) * size + x1 + size2] = val; >+ mat[(y1 - size2.Int()) * size.Int() + x1 + size2.Int()] = val; > } > } > >@@ -208,10 +209,10 @@ int SplashScreen::distance(int x0, int y > int dx0, dx1, dx, dy0, dy1, dy; > > dx0 = abs(x0 - x1); >- dx1 = size - dx0; >+ dx1 = size.Int() - dx0; > dx = dx0 < dx1 ? dx0 : dx1; > dy0 = abs(y0 - y1); >- dy1 = size - dy0; >+ dy1 = size.Int() - dy0; > dy = dy0 < dy1 ? dy0 : dy1; > return dx * dx + dy * dy; > } >@@ -222,7 +223,7 @@ int SplashScreen::distance(int x0, int y > // Hardcopy, and Graphic Arts IV, SPIE Vol. 3648, pp. 496-505, 1999. > void SplashScreen::buildSCDMatrix(int r) { > SplashScreenPoint *dots, *pts; >- int dotsLen, dotsSize; >+ SafeInt dotsLen, dotsSize; > char *tmpl; > char *grid; > int *region, *dist; >@@ -242,7 +243,7 @@ void SplashScreen::buildSCDMatrix(int r) > } > } > for (i = 0; i < size * size; ++i) { >- j = i + (int)((double)(size * size - i) * >+ j = i + (int)((double)(size.Int() * size.Int() - i) * > (double)rand() / ((double)RAND_MAX + 1.0)); > x = pts[i].x; > y = pts[i].y; >@@ -253,7 +254,7 @@ void SplashScreen::buildSCDMatrix(int r) > } > > // construct the circle template >- tmpl = (char *)gmallocn((r+1)*(r+1), sizeof(char)); >+ tmpl = (char *)gmallocn((SafeInt(r)+SafeInt(1))*(SafeInt(r)+SafeInt(1)), sizeof(char)); > for (y = 0; y <= r; ++y) { > for (x = 0; x <= r; ++x) { > tmpl[y*(r+1) + x] = (x * y <= r * r) ? 1 : 0; >@@ -264,7 +265,7 @@ void SplashScreen::buildSCDMatrix(int r) > grid = (char *)gmallocn(size * size, sizeof(char)); > for (y = 0; y < size; ++y) { > for (x = 0; x < size; ++x) { >- grid[y*size + x] = 0; >+ grid[y*size.Int() + x] = 0; > } > } > >@@ -272,27 +273,27 @@ void SplashScreen::buildSCDMatrix(int r) > dotsLen = 0; > dotsSize = 32; > dots = (SplashScreenPoint *)gmallocn(dotsSize, sizeof(SplashScreenPoint)); >- for (i = 0; i < size * size; ++i) { >+ for (i = 0; i < size.Int() * size.Int(); ++i) { > x = pts[i].x; > y = pts[i].y; >- if (!grid[y*size + x]) { >+ if (!grid[y*size.Int() + x]) { > if (dotsLen == dotsSize) { > dotsSize *= 2; > dots = (SplashScreenPoint *)greallocn(dots, dotsSize, > sizeof(SplashScreenPoint)); > } >- dots[dotsLen++] = pts[i]; >+ dots[(dotsLen++).Int()] = pts[i]; > for (yy = 0; yy <= r; ++yy) { >- y0 = (y + yy) % size; >- y1 = (y - yy + size) % size; >+ y0 = (y + yy) % size.Int(); >+ y1 = (y - yy + size.Int()) % size.Int(); > for (xx = 0; xx <= r; ++xx) { > if (tmpl[yy*(r+1) + xx]) { >- x0 = (x + xx) % size; >- x1 = (x - xx + size) % size; >- grid[y0*size + x0] = 1; >- grid[y0*size + x1] = 1; >- grid[y1*size + x0] = 1; >- grid[y1*size + x1] = 1; >+ x0 = (x + xx) % size.Int(); >+ x1 = (x - xx + size.Int()) % size.Int(); >+ grid[y0*size.Int() + x0] = 1; >+ grid[y0*size.Int() + x1] = 1; >+ grid[y1*size.Int() + x0] = 1; >+ grid[y1*size.Int() + x1] = 1; > } > } > } >@@ -316,17 +317,17 @@ void SplashScreen::buildSCDMatrix(int r) > dMin = d; > } > } >- region[y*size + x] = iMin; >- dist[y*size + x] = dMin; >+ region[y*size.Int() + x] = iMin; >+ dist[y*size.Int() + x] = dMin; > } > } > > // compute threshold values > for (i = 0; i < dotsLen; ++i) { > n = 0; >- for (y = 0; y < size; ++y) { >- for (x = 0; x < size; ++x) { >- if (region[y*size + x] == i) { >+ for (y = 0; y < size.Int(); ++y) { >+ for (x = 0; x < size.Int(); ++x) { >+ if (region[y*size.Int() + x] == i) { > pts[n].x = x; > pts[n].y = y; > pts[n].dist = distance(dots[i].x, dots[i].y, x, y); >@@ -337,7 +338,7 @@ void SplashScreen::buildSCDMatrix(int r) > qsort(pts, n, sizeof(SplashScreenPoint), &cmpDistances); > for (j = 0; j < n; ++j) { > // map values in [0 .. n-1] --> [255 .. 1] >- mat[pts[j].y * size + pts[j].x] = 255 - (254 * j) / (n - 1); >+ mat[pts[j].y * size.Int() + pts[j].x] = 255 - (254 * j) / (n - 1); > } > } > >@@ -351,7 +352,7 @@ void SplashScreen::buildSCDMatrix(int r) > SplashScreen::SplashScreen(SplashScreen *screen) { > size = screen->size; > mat = (Guchar *)gmallocn(size * size, sizeof(Guchar)); >- memcpy(mat, screen->mat, size * size * sizeof(Guchar)); >+ memcpy(mat, screen->mat, (size * size).Int() * sizeof(Guchar)); > minVal = screen->minVal; > maxVal = screen->maxVal; > } >@@ -369,13 +370,13 @@ int SplashScreen::test(int x, int y, Guc > if (value >= maxVal) { > return 1; > } >- if ((xx = x % size) < 0) { >+ if ((xx = x % size.Int()) < 0) { > xx = -xx; > } >- if ((yy = y % size) < 0) { >+ if ((yy = y % size.Int()) < 0) { > yy = -yy; > } >- return value < mat[yy * size + xx] ? 0 : 1; >+ return value < mat[yy * size.Int() + xx] ? 0 : 1; > } > > GBool SplashScreen::isStatic(Guchar value) { >Index: poppler-0.12.0/splash/SplashScreen.h >=================================================================== >--- poppler-0.12.0.orig/splash/SplashScreen.h >+++ poppler-0.12.0/splash/SplashScreen.h >@@ -12,11 +12,14 @@ > #endif > > #include "SplashTypes.h" >+#include "gmem.h" > > //------------------------------------------------------------------------ > // SplashScreen > //------------------------------------------------------------------------ > >+class SafeInt; >+ > class SplashScreen { > public: > >@@ -44,7 +47,8 @@ private: > void buildSCDMatrix(int r); > > Guchar *mat; // threshold matrix >- int size; // size of the threshold matrix >+ SafeInt size; // size of the threshold matrix >+ > Guchar minVal; // any pixel value below minVal generates > // solid black > Guchar maxVal; // any pixel value above maxVal generates >Index: poppler-0.12.0/splash/SplashT1Font.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashT1Font.cc >+++ poppler-0.12.0/splash/SplashT1Font.cc >@@ -197,7 +197,8 @@ GBool SplashT1Font::getGlyph(int c, int > GBool SplashT1Font::makeGlyph(int c, int xFrac, int yFrac, > SplashGlyphBitmap *bitmap, int x0, int y0, SplashClip *clip, SplashClipResult *clipRes) { > GLYPH *glyph; >- int n, i; >+ int i; >+ SafeInt n; > > if (aa) { > glyph = T1_AASetChar(t1libID, c, size, NULL); >@@ -217,7 +218,7 @@ GBool SplashT1Font::makeGlyph(int c, int > bitmap->data = (Guchar *)glyph->bits; > bitmap->freeData = gFalse; > } else { >- n = bitmap->h * ((bitmap->w + 7) >> 3); >+ n = SafeInt(bitmap->h) * ((SafeInt(bitmap->w) + SafeInt(7)) >> SafeInt(3)); > bitmap->data = (Guchar *)gmalloc(n); > for (i = 0; i < n; ++i) { > bitmap->data[i] = bitReverse[glyph->bits[i] & 0xff]; >Index: poppler-0.12.0/splash/SplashT1FontFile.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashT1FontFile.cc >+++ poppler-0.12.0/splash/SplashT1FontFile.cc >@@ -47,7 +47,7 @@ SplashFontFile *SplashT1FontFile::loadTy > int t1libIDA; > char **encTmp; > char *encStrTmp; >- int encStrSize; >+ SafeInt encStrSize; > char *encPtr; > int i; > >@@ -79,7 +79,7 @@ SplashFontFile *SplashT1FontFile::loadTy > encStrSize = 0; > for (i = 0; i < 256; ++i) { > if (encA[i]) { >- encStrSize += strlen(encA[i]) + 1; >+ encStrSize += SafeInt(strlen(encA[i])) + SafeInt(1); > } > } > encTmp = (char **)gmallocn(257, sizeof(char *)); >Index: poppler-0.12.0/splash/SplashXPath.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashXPath.cc >+++ poppler-0.12.0/splash/SplashXPath.cc >@@ -152,7 +152,7 @@ SplashXPath::SplashXPath(SplashPath *pat > xsp = x0; > ysp = y0; > curSubpath = i; >- curSubpathX = length; >+ curSubpathX = length.Int(); > ++i; > > } else { >@@ -241,7 +241,7 @@ SplashXPath::SplashXPath(SplashXPath *xP > length = xPath->length; > size = xPath->size; > segs = (SplashXPathSeg *)gmallocn(size, sizeof(SplashXPathSeg)); >- memcpy(segs, xPath->segs, length * sizeof(SplashXPathSeg)); >+ memcpy(segs, xPath->segs, length.Int() * sizeof(SplashXPathSeg)); > } > > SplashXPath::~SplashXPath() { >@@ -349,51 +349,51 @@ void SplashXPath::addSegment(SplashCoord > SplashCoord x1, SplashCoord y1, > GBool first, GBool last, GBool end0, GBool end1) { > grow(1); >- segs[length].x0 = x0; >- segs[length].y0 = y0; >- segs[length].x1 = x1; >- segs[length].y1 = y1; >- segs[length].flags = 0; >+ segs[length.Int()].x0 = x0; >+ segs[length.Int()].y0 = y0; >+ segs[length.Int()].x1 = x1; >+ segs[length.Int()].y1 = y1; >+ segs[length.Int()].flags = 0; > if (first) { >- segs[length].flags |= splashXPathFirst; >+ segs[length.Int()].flags |= splashXPathFirst; > } > if (last) { >- segs[length].flags |= splashXPathLast; >+ segs[length.Int()].flags |= splashXPathLast; > } > if (end0) { >- segs[length].flags |= splashXPathEnd0; >+ segs[length.Int()].flags |= splashXPathEnd0; > } > if (end1) { >- segs[length].flags |= splashXPathEnd1; >+ segs[length.Int()].flags |= splashXPathEnd1; > } > if (y1 == y0) { >- segs[length].dxdy = segs[length].dydx = 0; >- segs[length].flags |= splashXPathHoriz; >+ segs[length.Int()].dxdy = segs[length.Int()].dydx = 0; >+ segs[length.Int()].flags |= splashXPathHoriz; > if (x1 == x0) { >- segs[length].flags |= splashXPathVert; >+ segs[length.Int()].flags |= splashXPathVert; > } > } else if (x1 == x0) { >- segs[length].dxdy = segs[length].dydx = 0; >- segs[length].flags |= splashXPathVert; >+ segs[length.Int()].dxdy = segs[length.Int()].dydx = 0; >+ segs[length.Int()].flags |= splashXPathVert; > } else { > #if USE_FIXEDPOINT >- if (FixedPoint::divCheck(x1 - x0, y1 - y0, &segs[length].dxdy)) { >- segs[length].dydx = (SplashCoord)1 / segs[length].dxdy; >+ if (FixedPoint::divCheck(x1 - x0, y1 - y0, &segs[length.Int()].dxdy)) { >+ segs[length.Int()].dydx = (SplashCoord)1 / segs[length.Int()].dxdy; > } else { >- segs[length].dxdy = segs[length].dydx = 0; >+ segs[length.Int()].dxdy = segs[length.Int()].dydx = 0; > if (splashAbs(x1 - x0) > splashAbs(y1 - y0)) { >- segs[length].flags |= splashXPathHoriz; >+ segs[length.Int()].flags |= splashXPathHoriz; > } else { >- segs[length].flags |= splashXPathVert; >+ segs[length.Int()].flags |= splashXPathVert; > } > } > #else >- segs[length].dxdy = (x1 - x0) / (y1 - y0); >- segs[length].dydx = (SplashCoord)1 / segs[length].dxdy; >+ segs[length.Int()].dxdy = (x1 - x0) / (y1 - y0); >+ segs[length.Int()].dydx = (SplashCoord)1 / segs[length.Int()].dxdy; > #endif > } > if (y0 > y1) { >- segs[length].flags |= splashXPathFlip; >+ segs[length.Int()].flags |= splashXPathFlip; > } > ++length; > } >@@ -439,5 +439,5 @@ void SplashXPath::aaScale() { > } > > void SplashXPath::sort() { >- qsort(segs, length, sizeof(SplashXPathSeg), &cmpXPathSegs); >+ qsort(segs, length.Int(), sizeof(SplashXPathSeg), &cmpXPathSegs); > } >Index: poppler-0.12.0/splash/SplashXPath.h >=================================================================== >--- poppler-0.12.0.orig/splash/SplashXPath.h >+++ poppler-0.12.0/splash/SplashXPath.h >@@ -88,7 +88,7 @@ protected: > GBool first, GBool last, GBool end0, GBool end1); > > SplashXPathSeg *segs; >- int length, size; // length and size of segs array >+ SafeInt length, size; // length and size of segs array > > friend class SplashXPathScanner; > friend class SplashClip; >Index: poppler-0.12.0/splash/SplashXPathScanner.cc >=================================================================== >--- poppler-0.12.0.orig/splash/SplashXPathScanner.cc >+++ poppler-0.12.0/splash/SplashXPathScanner.cc >@@ -106,7 +106,8 @@ SplashXPathScanner::SplashXPathScanner(S > interY = yMin - 1; > xPathIdx = 0; > inter = NULL; >- interLen = interSize = 0; >+ interLen = 0; >+ interSize = 0; > } > > SplashXPathScanner::~SplashXPathScanner() { >Index: poppler-0.12.0/splash/SplashXPathScanner.h >=================================================================== >--- poppler-0.12.0.orig/splash/SplashXPathScanner.h >+++ poppler-0.12.0/splash/SplashXPathScanner.h >@@ -79,7 +79,7 @@ private: > // computeIntersections > SplashIntersect *inter; // intersections array for <interY> > int interLen; // number of intersections in <inter> >- int interSize; // size of the <inter> array >+ SafeInt interSize; // size of the <inter> array > }; > > #endif >Index: poppler-0.12.0/poppler/Annot.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Annot.cc >+++ poppler-0.12.0/poppler/Annot.cc >@@ -4362,7 +4362,7 @@ Annot3D::Activation::Activation(Dict *di > Annots::Annots(XRef *xref, Catalog *catalog, Object *annotsObj) { > Annot *annot; > Object obj1; >- int size; >+ SafeInt size; > int i; > > annots = NULL; >Index: poppler-0.12.0/poppler/Array.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Array.cc >+++ poppler-0.12.0/poppler/Array.cc >@@ -60,7 +60,7 @@ void Array::add(Object *elem) { > } > elems = (Object *)greallocn(elems, size, sizeof(Object)); > } >- elems[length] = *elem; >+ elems[length.Int()] = *elem; > ++length; > } > >Index: poppler-0.12.0/poppler/Array.h >=================================================================== >--- poppler-0.12.0.orig/poppler/Array.h >+++ poppler-0.12.0/poppler/Array.h >@@ -49,7 +49,7 @@ public: > int decRef() { return --ref; } > > // Get number of elements. >- int getLength() { return length; } >+ int getLength() { return length.Int(); } > > // Add an element. > void add(Object *elem); >@@ -63,8 +63,8 @@ private: > > XRef *xref; // the xref table for this PDF file > Object *elems; // array of elements >- int size; // size of <elems> array >- int length; // number of elements in array >+ SafeInt size; // size of <elems> array >+ SafeInt length; // number of elements in array > int ref; // reference count > }; > >Index: poppler-0.12.0/poppler/Catalog.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Catalog.cc >+++ poppler-0.12.0/poppler/Catalog.cc >@@ -65,7 +65,7 @@ Catalog::Catalog(XRef *xrefA) { > xref = xrefA; > pages = NULL; > pageRefs = NULL; >- numPages = pagesSize = 0; >+ pagesSize = numPages = 0; > baseURI = NULL; > pageLabelInfo = NULL; > form = NULL; >@@ -318,7 +318,7 @@ int Catalog::readPageTree(Dict *pagesDic > pagesSize += 32; > pages = (Page **)greallocn(pages, pagesSize, sizeof(Page *)); > pageRefs = (Ref *)greallocn(pageRefs, pagesSize, sizeof(Ref)); >- for (j = pagesSize - 32; j < pagesSize; ++j) { >+ for (j = (pagesSize - 32).Int(); j < pagesSize; ++j) { > pages[j] = NULL; > pageRefs[j].num = -1; > pageRefs[j].gen = -1; >Index: poppler-0.12.0/poppler/Catalog.h >=================================================================== >--- poppler-0.12.0.orig/poppler/Catalog.h >+++ poppler-0.12.0/poppler/Catalog.h >@@ -228,7 +228,7 @@ private: > Ref *pageRefs; // object ID for each page > Form *form; > int numPages; // number of pages >- int pagesSize; // size of pages array >+ SafeInt pagesSize; // size of pages array > Object dests; // named destination dictionary > NameTree destNameTree; // named destination name-tree > NameTree embeddedFileNameTree; // embedded file name-tree >Index: poppler-0.12.0/poppler/CharCodeToUnicode.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/CharCodeToUnicode.cc >+++ poppler-0.12.0/poppler/CharCodeToUnicode.cc >@@ -74,7 +74,8 @@ CharCodeToUnicode *CharCodeToUnicode::pa > GooString *collection) { > FILE *f; > Unicode *mapA; >- CharCode size, mapLenA; >+ CharCode mapLenA; >+ SafeInt size; > char buf[64]; > Unicode u; > CharCodeToUnicode *ctu; >@@ -116,7 +117,8 @@ CharCodeToUnicode *CharCodeToUnicode::pa > FILE *f; > Unicode *mapA; > CharCodeToUnicodeString *sMapA; >- CharCode size, oldSize, len, sMapSizeA, sMapLenA; >+ CharCode len, sMapLenA; >+ SafeInt size, oldSize, sMapSizeA; > char buf[256]; > char *tok; > Unicode u0; >@@ -134,7 +136,7 @@ CharCodeToUnicode *CharCodeToUnicode::pa > > size = 4096; > mapA = (Unicode *)gmallocn(size, sizeof(Unicode)); >- memset(mapA, 0, size * sizeof(Unicode)); >+ memset(mapA, 0, size.Int() * sizeof(Unicode)); > len = 0; > sMapA = NULL; > sMapSizeA = sMapLenA = 0; >@@ -173,7 +175,7 @@ CharCodeToUnicode *CharCodeToUnicode::pa > size *= 2; > } > mapA = (Unicode *)greallocn(mapA, size, sizeof(Unicode)); >- memset(mapA + oldSize, 0, (size - oldSize) * sizeof(Unicode)); >+ memset(mapA + oldSize.Int(), 0, (size - oldSize).Int() * sizeof(Unicode)); > } > if (n == 1) { > mapA[u0] = uBuf[0]; >@@ -199,7 +201,7 @@ CharCodeToUnicode *CharCodeToUnicode::pa > fclose(f); > > ctu = new CharCodeToUnicode(fileName->copy(), mapA, len, gTrue, >- sMapA, sMapLenA, sMapSizeA); >+ sMapA, sMapLenA, sMapSizeA.Int()); > gfree(mapA); > gfree(uBuf); > return ctu; >@@ -360,7 +362,7 @@ void CharCodeToUnicode::addMapping(CharC > > if (code >= mapLen) { > oldLen = mapLen; >- mapLen = (code + 256) & ~255; >+ mapLen = (SafeInt(code) + 256).Int() & ~255; > map = (Unicode *)greallocn(map, mapLen, sizeof(Unicode)); > for (i = oldLen; i < mapLen; ++i) { > map[i] = 0; >@@ -404,7 +406,7 @@ CharCodeToUnicode::CharCodeToUnicode(Goo > map[i] = 0; > } > sMap = NULL; >- sMapLen = sMapSize = 0; >+ sMapSize = sMapLen = 0; > refCnt = 1; > #if MULTITHREADED > gInitMutex(&mutex); >Index: poppler-0.12.0/poppler/CharCodeToUnicode.h >=================================================================== >--- poppler-0.12.0.orig/poppler/CharCodeToUnicode.h >+++ poppler-0.12.0/poppler/CharCodeToUnicode.h >@@ -104,7 +104,8 @@ private: > Unicode *map; > CharCode mapLen; > CharCodeToUnicodeString *sMap; >- int sMapLen, sMapSize; >+ int sMapLen; >+ SafeInt sMapSize; > int refCnt; > #if MULTITHREADED > GooMutex mutex; >Index: poppler-0.12.0/poppler/Decrypt.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Decrypt.cc >+++ poppler-0.12.0/poppler/Decrypt.cc >@@ -130,7 +130,7 @@ GBool Decrypt::makeFileKey2(int encVersi > GBool ok; > > // generate file key >- buf = (Guchar *)gmalloc(72 + fileID->getLength()); >+ buf = (Guchar *)gmalloc((SafeInt(72) + SafeInt(fileID->getLength())).Int()); > if (userPassword) { > len = userPassword->getLength(); > if (len < 32) { >Index: poppler-0.12.0/poppler/Dict.h >=================================================================== >--- poppler-0.12.0.orig/poppler/Dict.h >+++ poppler-0.12.0/poppler/Dict.h >@@ -88,7 +88,7 @@ private: > > XRef *xref; // the xref table for this PDF file > DictEntry *entries; // array of entries >- int size; // size of <entries> array >+ SafeInt size; // size of <entries> array > int length; // number of entries in dictionary > int ref; // reference count > >Index: poppler-0.12.0/poppler/Function.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Function.cc >+++ poppler-0.12.0/poppler/Function.cc >@@ -233,7 +233,7 @@ SampledFunction::SampledFunction(Object > } > > //----- buffer >- sBuf = (double *)gmallocn(1 << m, sizeof(double)); >+ sBuf = (double *)gmallocn((SafeInt(1) << m).Int(), sizeof(double)); > > //----- get the stream > if (!funcObj->isStream()) { >@@ -385,8 +385,8 @@ SampledFunction::~SampledFunction() { > SampledFunction::SampledFunction(SampledFunction *func) { > memcpy(this, func, sizeof(SampledFunction)); > samples = (double *)gmallocn(nSamples, sizeof(double)); >- memcpy(samples, func->samples, nSamples * sizeof(double)); >- sBuf = (double *)gmallocn(1 << m, sizeof(double)); >+ memcpy(samples, func->samples, (nSamples * sizeof(double)).Int()); >+ sBuf = (double *)gmallocn((SafeInt(1) << m).Int(), sizeof(double)); > } > > void SampledFunction::transform(double *in, double *out) { >@@ -591,8 +591,8 @@ StitchingFunction::StitchingFunction(Obj > } > k = obj1.arrayGetLength(); > funcs = (Function **)gmallocn(k, sizeof(Function *)); >- bounds = (double *)gmallocn(k + 1, sizeof(double)); >- encode = (double *)gmallocn(2 * k, sizeof(double)); >+ bounds = (double *)gmallocn(k + SafeInt(1), sizeof(double)); >+ encode = (double *)gmallocn(SafeInt(2) * k, sizeof(double)); > scale = (double *)gmallocn(k, sizeof(double)); > for (i = 0; i < k; ++i) { > funcs[i] = NULL; >@@ -625,7 +625,7 @@ StitchingFunction::StitchingFunction(Obj > bounds[i] = obj2.getNum(); > obj2.free(); > } >- bounds[k] = domain[0][1]; >+ bounds[k.Int()] = domain[0][1]; > obj1.free(); > > //----- Encode >@@ -674,12 +674,12 @@ StitchingFunction::StitchingFunction(Sti > for (i = 0; i < k; ++i) { > funcs[i] = func->funcs[i]->copy(); > } >- bounds = (double *)gmallocn(k + 1, sizeof(double)); >- memcpy(bounds, func->bounds, (k + 1) * sizeof(double)); >- encode = (double *)gmallocn(2 * k, sizeof(double)); >- memcpy(encode, func->encode, 2 * k * sizeof(double)); >+ bounds = (double *)gmallocn(k + SafeInt(1), sizeof(double)); >+ memcpy(bounds, func->bounds, ((k + 1) * sizeof(double)).Int()); >+ encode = (double *)gmallocn(SafeInt(2) * k, sizeof(double)); >+ memcpy(encode, func->encode, (2 * k * sizeof(double)).Int()); > scale = (double *)gmallocn(k, sizeof(double)); >- memcpy(scale, func->scale, k * sizeof(double)); >+ memcpy(scale, func->scale, (k * sizeof(double)).Int()); > ok = gTrue; > } > >@@ -1155,7 +1155,7 @@ PostScriptFunction::PostScriptFunction(O > PostScriptFunction::PostScriptFunction(PostScriptFunction *func) { > memcpy(this, func, sizeof(PostScriptFunction)); > code = (PSObject *)gmallocn(codeSize, sizeof(PSObject)); >- memcpy(code, func->code, codeSize * sizeof(PSObject)); >+ memcpy(code, func->code, (codeSize * sizeof(PSObject)).Int()); > codeString = func->codeString->copy(); > stack = new PSStack(); > memcpy(stack, func->stack, sizeof(PSStack)); >Index: poppler-0.12.0/poppler/Function.h >=================================================================== >--- poppler-0.12.0.orig/poppler/Function.h >+++ poppler-0.12.0/poppler/Function.h >@@ -144,7 +144,7 @@ private: > inputMul[funcMaxInputs]; > int idxMul[funcMaxInputs]; // sample array index multipliers > double *samples; // the samples >- int nSamples; // size of the samples array >+ SafeInt nSamples; // size of the samples array > double *sBuf; // buffer for the transform function > GBool ok; > }; >@@ -191,7 +191,7 @@ public: > virtual void transform(double *in, double *out); > virtual GBool isOk() { return ok; } > >- int getNumFuncs() { return k; } >+ int getNumFuncs() { return k.Int(); } > Function *getFunc(int i) { return funcs[i]; } > double *getBounds() { return bounds; } > double *getEncode() { return encode; } >@@ -201,7 +201,7 @@ private: > > StitchingFunction(StitchingFunction *func); > >- int k; >+ SafeInt k; > Function **funcs; > double *bounds; > double *encode; >@@ -236,7 +236,7 @@ private: > GooString *codeString; > PSObject *code; > PSStack *stack; >- int codeSize; >+ SafeInt codeSize; > GBool ok; > PopplerCache *cache; > }; >Index: poppler-0.12.0/poppler/GfxFont.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/GfxFont.cc >+++ poppler-0.12.0/poppler/GfxFont.cc >@@ -480,7 +480,8 @@ char *GfxFont::readEmbFontFile(XRef *xre > Object obj1, obj2; > Stream *str; > int c; >- int size, i; >+ SafeInt size; >+ int i; > > obj1.initRef(embFontID.num, embFontID.gen); > obj1.fetch(xref, &obj2); >@@ -494,12 +495,12 @@ char *GfxFont::readEmbFontFile(XRef *xre > str = obj2.getStream(); > > buf = NULL; >- i = size = 0; >+ size = i = 0; > str->reset(); > while ((c = str->getChar()) != EOF) { > if (i == size) { > size += 4096; >- buf = (char *)grealloc(buf, size); >+ buf = (char *)grealloc(buf, size.Int()); > } > buf[i++] = c; > } >@@ -1327,7 +1328,8 @@ GfxCIDFont::GfxCIDFont(XRef *xref, char > CharCode c; > Unicode *uBuf; > int c1, c2; >- int excepsSize, i, j, k, n; >+ int j, k, n; >+ SafeInt i, excepsSize; > > refCnt = 1; > ascent = 0.95; >@@ -1523,10 +1525,10 @@ GfxCIDFont::GfxCIDFont(XRef *xref, char > excepsSize = 0; > i = 0; > while (i + 1 < obj1.arrayGetLength()) { >- obj1.arrayGet(i, &obj2); >- obj1.arrayGet(i + 1, &obj3); >- if (obj2.isInt() && obj3.isInt() && i + 2 < obj1.arrayGetLength()) { >- if (obj1.arrayGet(i + 2, &obj4)->isNum()) { >+ obj1.arrayGet(i.Int(), &obj2); >+ obj1.arrayGet((i + 1).Int(), &obj3); >+ if (obj2.isInt() && obj3.isInt() && (i + 2).Int() < obj1.arrayGetLength()) { >+ if (obj1.arrayGet((i + 2).Int(), &obj4)->isNum()) { > if (widths.nExceps == excepsSize) { > excepsSize += 16; > widths.exceps = (GfxFontCIDWidthExcep *) >@@ -1544,7 +1546,7 @@ GfxCIDFont::GfxCIDFont(XRef *xref, char > i += 3; > } else if (obj2.isInt() && obj3.isArray()) { > if (widths.nExceps + obj3.arrayGetLength() > excepsSize) { >- excepsSize = (widths.nExceps + obj3.arrayGetLength() + 15) & ~15; >+ excepsSize = (SafeInt(widths.nExceps) + SafeInt(obj3.arrayGetLength()) + 15).Int() & ~15; > widths.exceps = (GfxFontCIDWidthExcep *) > greallocn(widths.exceps, > excepsSize, sizeof(GfxFontCIDWidthExcep)); >@@ -1594,12 +1596,12 @@ GfxCIDFont::GfxCIDFont(XRef *xref, char > excepsSize = 0; > i = 0; > while (i + 1 < obj1.arrayGetLength()) { >- obj1.arrayGet(i, &obj2); >- obj1.arrayGet(i+ 1, &obj3); >- if (obj2.isInt() && obj3.isInt() && i + 4 < obj1.arrayGetLength()) { >- if (obj1.arrayGet(i + 2, &obj4)->isNum() && >- obj1.arrayGet(i + 3, &obj5)->isNum() && >- obj1.arrayGet(i + 4, &obj6)->isNum()) { >+ obj1.arrayGet(i.Int(), &obj2); >+ obj1.arrayGet((i+ 1).Int(), &obj3); >+ if (obj2.isInt() && obj3.isInt() && (i + 4).Int() < obj1.arrayGetLength()) { >+ if (obj1.arrayGet((i + 2).Int(), &obj4)->isNum() && >+ obj1.arrayGet((i + 3).Int(), &obj5)->isNum() && >+ obj1.arrayGet((i + 4).Int(), &obj6)->isNum()) { > if (widths.nExcepsV == excepsSize) { > excepsSize += 16; > widths.excepsV = (GfxFontCIDWidthExcepV *) >Index: poppler-0.12.0/poppler/GfxState.h >=================================================================== >--- poppler-0.12.0.orig/poppler/GfxState.h >+++ poppler-0.12.0/poppler/GfxState.h >@@ -1027,7 +1027,7 @@ private: > GBool *curve; // curve[i] => point i is a control point > // for a Bezier curve > int n; // number of points >- int size; // size of x/y arrays >+ SafeInt size; // size of x/y arrays > GBool closed; // set if path is closed > > GfxSubpath(GfxSubpath *subpath); >@@ -1053,12 +1053,12 @@ public: > GBool isPath() { return n > 0; } > > // Get subpaths. >- int getNumSubpaths() { return n; } >+ int getNumSubpaths() { return n.Int(); } > GfxSubpath *getSubpath(int i) { return subpaths[i]; } > > // Get last point on last subpath. >- double getLastX() { return subpaths[n-1]->getLastX(); } >- double getLastY() { return subpaths[n-1]->getLastY(); } >+ double getLastX() { return subpaths[n.Int()-1]->getLastX(); } >+ double getLastY() { return subpaths[n.Int()-1]->getLastY(); } > > // Move the current point. > void moveTo(double x, double y); >@@ -1084,11 +1084,11 @@ private: > GBool justMoved; // set if a new subpath was just started > double firstX, firstY; // first point in new subpath > GfxSubpath **subpaths; // subpaths >- int n; // number of subpaths >- int size; // size of subpaths array >+ SafeInt n; // number of subpaths >+ SafeInt size; // size of subpaths array > > GfxPath(GBool justMoved1, double firstX1, double firstY1, >- GfxSubpath **subpaths1, int n1, int size1); >+ GfxSubpath **subpaths1, SafeInt n1, SafeInt size1); > }; > > //------------------------------------------------------------------------ >Index: poppler-0.12.0/poppler/GfxState.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/GfxState.cc >+++ poppler-0.12.0/poppler/GfxState.cc >@@ -1695,7 +1695,7 @@ GfxIndexedColorSpace::GfxIndexedColorSpa > int indexHighA) { > base = baseA; > indexHigh = indexHighA; >- lookup = (Guchar *)gmallocn((indexHigh + 1) * base->getNComps(), >+ lookup = (Guchar *)gmallocn((SafeInt(indexHigh) + SafeInt(1)) * SafeInt(base->getNComps()), > sizeof(Guchar)); > } > >@@ -3123,7 +3123,7 @@ GfxGouraudTriangleShading::GfxGouraudTri > vertices = (GfxGouraudVertex *)gmallocn(nVertices, sizeof(GfxGouraudVertex)); > memcpy(vertices, shading->vertices, nVertices * sizeof(GfxGouraudVertex)); > nTriangles = shading->nTriangles; >- triangles = (int (*)[3])gmallocn(nTriangles * 3, sizeof(int)); >+ triangles = (int (*)[3])gmallocn(SafeInt(nTriangles) * SafeInt(3), sizeof(int)); > memcpy(triangles, shading->triangles, nTriangles * 3 * sizeof(int)); > nFuncs = shading->nFuncs; > for (i = 0; i < nFuncs; ++i) { >@@ -3154,7 +3154,8 @@ GfxGouraudTriangleShading *GfxGouraudTri > double cMul[gfxColorMaxComps]; > GfxGouraudVertex *verticesA; > int (*trianglesA)[3]; >- int nComps, nVerticesA, nTrianglesA, vertSize, triSize; >+ int nComps, nVerticesA, nTrianglesA; >+ SafeInt vertSize, triSize; > Guint x, y, flag; > Guint c[gfxColorMaxComps]; > GfxShadingBitBuf *bitBuf; >@@ -3273,11 +3274,11 @@ GfxGouraudTriangleShading *GfxGouraudTri > break; > } > if (nVerticesA == vertSize) { >- int oldVertSize = vertSize; >+ SafeInt oldVertSize = vertSize; > vertSize = (vertSize == 0) ? 16 : 2 * vertSize; > verticesA = (GfxGouraudVertex *) > greallocn(verticesA, vertSize, sizeof(GfxGouraudVertex)); >- memset(verticesA + oldVertSize, 0, (vertSize - oldVertSize) * sizeof(GfxGouraudVertex)); >+ memset(verticesA + oldVertSize.Int(), 0, (vertSize - oldVertSize).Int() * sizeof(GfxGouraudVertex)); > } > verticesA[nVerticesA].x = xMin + xMul * (double)x; > verticesA[nVerticesA].y = yMin + yMul * (double)y; >@@ -3294,7 +3295,7 @@ GfxGouraudTriangleShading *GfxGouraudTri > if (nTrianglesA == triSize) { > triSize = (triSize == 0) ? 16 : 2 * triSize; > trianglesA = (int (*)[3]) >- greallocn(trianglesA, triSize * 3, sizeof(int)); >+ greallocn(trianglesA, SafeInt(triSize) * SafeInt(3), sizeof(int)); > } > if (state == 2) { > trianglesA[nTrianglesA][0] = nVerticesA - 3; >@@ -3319,8 +3320,9 @@ GfxGouraudTriangleShading *GfxGouraudTri > delete bitBuf; > if (typeA == 5) { > nRows = nVerticesA / vertsPerRow; >- nTrianglesA = (nRows - 1) * 2 * (vertsPerRow - 1); >- trianglesA = (int (*)[3])gmallocn(nTrianglesA * 3, sizeof(int)); >+ nTrianglesA = ((SafeInt(nRows) - SafeInt(1)) * SafeInt(2) >+ * (SafeInt(vertsPerRow) - SafeInt(1))).Int(); >+ trianglesA = (int (*)[3])gmallocn(SafeInt(nTrianglesA) * SafeInt(3), sizeof(int)); > k = 0; > for (i = 0; i < nRows - 1; ++i) { > for (j = 0; j < vertsPerRow - 1; ++j) { >@@ -3461,7 +3463,8 @@ GfxPatchMeshShading *GfxPatchMeshShading > double xMul, yMul; > double cMul[gfxColorMaxComps]; > GfxPatch *patchesA, *p; >- int nComps, nPatchesA, patchesSize, nPts, nColors; >+ int nComps, nPatchesA, nPts, nColors; >+ SafeInt patchesSize; > Guint flag; > double x[16], y[16]; > Guint xi, yi; >@@ -3597,11 +3600,11 @@ GfxPatchMeshShading *GfxPatchMeshShading > break; > } > if (nPatchesA == patchesSize) { >- int oldPatchesSize = patchesSize; >+ SafeInt oldPatchesSize = patchesSize; > patchesSize = (patchesSize == 0) ? 16 : 2 * patchesSize; > patchesA = (GfxPatch *)greallocn(patchesA, > patchesSize, sizeof(GfxPatch)); >- memset(patchesA + oldPatchesSize, 0, (patchesSize - oldPatchesSize) * sizeof(GfxPatch)); >+ memset(patchesA + oldPatchesSize.Int(), 0, (patchesSize - oldPatchesSize).Int() * sizeof(GfxPatch)); > } > p = &patchesA[nPatchesA]; > if (typeA == 6) { >@@ -4058,7 +4061,7 @@ GfxImageColorMap::GfxImageColorMap(int b > useByteLookup = gTrue; > } > for (k = 0; k < nComps2; ++k) { >- lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1, >+ lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1), > sizeof(GfxColorComp)); > for (i = 0; i <= maxPixel; ++i) { > j = (int)(decodeLow[0] + (i * decodeRange[0]) / maxPixel + 0.5); >@@ -4081,11 +4084,11 @@ GfxImageColorMap::GfxImageColorMap(int b > nComps2 = colorSpace2->getNComps(); > sepFunc = sepCS->getFunc(); > if (colorSpace2->useGetGrayLine() || colorSpace2->useGetRGBLine()) { >- byte_lookup = (Guchar *)gmallocn ((maxPixel + 1), nComps2); >+ byte_lookup = (Guchar *)gmallocn ((SafeInt(maxPixel) + SafeInt(1)), nComps2); > useByteLookup = gTrue; > } > for (k = 0; k < nComps2; ++k) { >- lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1, >+ lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1), > sizeof(GfxColorComp)); > for (i = 0; i <= maxPixel; ++i) { > x[0] = decodeLow[0] + (i * decodeRange[0]) / maxPixel; >@@ -4098,11 +4101,11 @@ GfxImageColorMap::GfxImageColorMap(int b > break; > default: > if (colorSpace->useGetGrayLine() || colorSpace->useGetRGBLine()) { >- byte_lookup = (Guchar *)gmallocn ((maxPixel + 1), nComps); >+ byte_lookup = (Guchar *)gmallocn ((SafeInt(maxPixel) + SafeInt(1)), nComps); > useByteLookup = gTrue; > } > for (k = 0; k < nComps; ++k) { >- lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1, >+ lookup[k] = (GfxColorComp *)gmallocn(SafeInt(maxPixel) + SafeInt(1), > sizeof(GfxColorComp)); > for (i = 0; i <= maxPixel; ++i) { > mapped = decodeLow[k] + (i * decodeRange[k]) / maxPixel; >@@ -4130,7 +4133,8 @@ GfxImageColorMap::GfxImageColorMap(int b > } > > GfxImageColorMap::GfxImageColorMap(GfxImageColorMap *colorMap) { >- int n, i, k; >+ int i, k; >+ SafeInt n; > > colorSpace = colorMap->colorSpace->copy(); > bits = colorMap->bits; >@@ -4145,25 +4149,25 @@ GfxImageColorMap::GfxImageColorMap(GfxIm > colorSpace2 = ((GfxIndexedColorSpace *)colorSpace)->getBase(); > for (k = 0; k < nComps2; ++k) { > lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp)); >- memcpy(lookup[k], colorMap->lookup[k], n * sizeof(GfxColorComp)); >+ memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp)); > } > } else if (colorSpace->getMode() == csSeparation) { > colorSpace2 = ((GfxSeparationColorSpace *)colorSpace)->getAlt(); > for (k = 0; k < nComps2; ++k) { > lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp)); >- memcpy(lookup[k], colorMap->lookup[k], n * sizeof(GfxColorComp)); >+ memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp)); > } > } else { > for (k = 0; k < nComps; ++k) { > lookup[k] = (GfxColorComp *)gmallocn(n, sizeof(GfxColorComp)); >- memcpy(lookup[k], colorMap->lookup[k], n * sizeof(GfxColorComp)); >+ memcpy(lookup[k], colorMap->lookup[k], n.Int() * sizeof(GfxColorComp)); > } > } > if (colorMap->byte_lookup) { > int nc = colorSpace2 ? nComps2 : nComps; > > byte_lookup = (Guchar *)gmallocn (n, nc); >- memcpy(byte_lookup, colorMap->byte_lookup, n * nc); >+ memcpy(byte_lookup, colorMap->byte_lookup, n.Int() * nc); > } > for (i = 0; i < nComps; ++i) { > decodeLow[i] = colorMap->decodeLow[i]; >@@ -4432,7 +4436,7 @@ GfxPath::~GfxPath() { > > // Used for copy(). > GfxPath::GfxPath(GBool justMoved1, double firstX1, double firstY1, >- GfxSubpath **subpaths1, int n1, int size1) { >+ GfxSubpath **subpaths1, SafeInt n1, SafeInt size1) { > int i; > > justMoved = justMoved1; >@@ -4458,11 +4462,11 @@ void GfxPath::lineTo(double x, double y) > subpaths = (GfxSubpath **) > greallocn(subpaths, size, sizeof(GfxSubpath *)); > } >- subpaths[n] = new GfxSubpath(firstX, firstY); >+ subpaths[n.Int()] = new GfxSubpath(firstX, firstY); > ++n; > justMoved = gFalse; > } >- subpaths[n-1]->lineTo(x, y); >+ subpaths[n.Int()-1]->lineTo(x, y); > } > > void GfxPath::curveTo(double x1, double y1, double x2, double y2, >@@ -4473,11 +4477,11 @@ void GfxPath::curveTo(double x1, double > subpaths = (GfxSubpath **) > greallocn(subpaths, size, sizeof(GfxSubpath *)); > } >- subpaths[n] = new GfxSubpath(firstX, firstY); >+ subpaths[n.Int()] = new GfxSubpath(firstX, firstY); > ++n; > justMoved = gFalse; > } >- subpaths[n-1]->curveTo(x1, y1, x2, y2, x3, y3); >+ subpaths[n.Int()-1]->curveTo(x1, y1, x2, y2, x3, y3); > } > > void GfxPath::close() { >@@ -4489,11 +4493,11 @@ void GfxPath::close() { > subpaths = (GfxSubpath **) > greallocn(subpaths, size, sizeof(GfxSubpath *)); > } >- subpaths[n] = new GfxSubpath(firstX, firstY); >+ subpaths[n.Int()] = new GfxSubpath(firstX, firstY); > ++n; > justMoved = gFalse; > } >- subpaths[n-1]->close(); >+ subpaths[n.Int()-1]->close(); > } > > void GfxPath::append(GfxPath *path) { >@@ -4505,7 +4509,7 @@ void GfxPath::append(GfxPath *path) { > greallocn(subpaths, size, sizeof(GfxSubpath *)); > } > for (i = 0; i < path->n; ++i) { >- subpaths[n++] = path->subpaths[i]->copy(); >+ subpaths[(n++).Int()] = path->subpaths[i]->copy(); > } > justMoved = gFalse; > } >Index: poppler-0.12.0/utils/ImageOutputDev.cc >=================================================================== >--- poppler-0.12.0.orig/utils/ImageOutputDev.cc >+++ poppler-0.12.0/utils/ImageOutputDev.cc >@@ -48,7 +48,7 @@ > > ImageOutputDev::ImageOutputDev(char *fileRootA, GBool dumpJPEGA) { > fileRoot = copyString(fileRootA); >- fileName = (char *)gmalloc(strlen(fileRoot) + 20); >+ fileName = (char *)gmalloc((SafeInt(strlen(fileRoot)) + SafeInt(20)).Int()); > dumpJPEG = dumpJPEGA; > imgNum = 0; > ok = gTrue; >Index: poppler-0.12.0/poppler/JArithmeticDecoder.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/JArithmeticDecoder.cc >+++ poppler-0.12.0/poppler/JArithmeticDecoder.cc >@@ -7,6 +7,7 @@ > //======================================================================== > > #include <config.h> >+#include <stdlib.h> > > #ifdef USE_GCC_PRAGMAS > #pragma implementation >@@ -47,6 +48,10 @@ void JArithmeticDecoderStats::copyFrom(J > } > > void JArithmeticDecoderStats::setEntry(Guint cx, int i, int mps) { >+ if (cx >= contextSize) { >+ fprintf(stderr, "index out of bounds"); >+ exit(1); >+ } > cxTab[cx] = (i << 1) + mps; > } > >Index: poppler-0.12.0/poppler/JBIG2Stream.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/JBIG2Stream.cc >+++ poppler-0.12.0/poppler/JBIG2Stream.cc >@@ -702,7 +702,7 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, > { > w = wA; > h = hA; >- line = (wA + 7) >> 3; >+ line = (SafeInt(wA) + SafeInt(7) >> 3).Int(); > > if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) { > error(-1, "invalid width/height"); >@@ -1599,7 +1599,7 @@ GBool JBIG2Stream::readSymbolDictSeg(Gui > } > > // get the input symbol bitmaps >- bitmaps = (JBIG2Bitmap **)gmallocn(numInputSyms + numNewSyms, >+ bitmaps = (JBIG2Bitmap **)gmallocn(SafeInt(numInputSyms) + SafeInt(numNewSyms), > sizeof(JBIG2Bitmap *)); > for (i = 0; i < numInputSyms + numNewSyms; ++i) { > bitmaps[i] = NULL; >@@ -1927,7 +1927,8 @@ void JBIG2Stream::readTextRegionSeg(Guin > int sOffset; > Guint huffFlags, huffFS, huffDS, huffDT; > Guint huffRDW, huffRDH, huffRDX, huffRDY, huffRSize; >- Guint numInstances, numSyms, symCodeLen; >+ Guint numInstances, symCodeLen; >+ SafeInt numSyms; > int atx[2], aty[2]; > Guint i, k, kk; > int j; >@@ -2130,7 +2131,7 @@ void JBIG2Stream::readTextRegionSeg(Guin > runLengthTab[35].prefixLen = 0; > runLengthTab[35].rangeLen = jbig2HuffmanEOT; > huffDecoder->buildTable(runLengthTab, 35); >- symCodeTab = (JBIG2HuffmanTable *)gmallocn(numSyms + 1, >+ symCodeTab = (JBIG2HuffmanTable *)gmallocn(numSyms + SafeInt(1), > sizeof(JBIG2HuffmanTable)); > for (i = 0; i < numSyms; ++i) { > symCodeTab[i].val = i; >@@ -2152,9 +2153,9 @@ void JBIG2Stream::readTextRegionSeg(Guin > symCodeTab[i++].prefixLen = j; > } > } >- symCodeTab[numSyms].prefixLen = 0; >- symCodeTab[numSyms].rangeLen = jbig2HuffmanEOT; >- huffDecoder->buildTable(symCodeTab, numSyms); >+ symCodeTab[numSyms.Int()].prefixLen = 0; >+ symCodeTab[numSyms.Int()].rangeLen = jbig2HuffmanEOT; >+ huffDecoder->buildTable(symCodeTab, numSyms.Int()); > huffDecoder->reset(); > > // set up the arithmetic decoder >@@ -2168,7 +2169,7 @@ void JBIG2Stream::readTextRegionSeg(Guin > } > > bitmap = readTextRegion(huff, refine, w, h, numInstances, >- logStrips, numSyms, symCodeTab, symCodeLen, syms, >+ logStrips, numSyms.Int(), symCodeTab, symCodeLen, syms, > defPixel, combOp, transposed, refCorner, sOffset, > huffFSTable, huffDSTable, huffDTTable, > huffRDWTable, huffRDHTable, >@@ -2781,6 +2782,7 @@ JBIG2Bitmap *JBIG2Stream::readGenericBit > error(curStr->getPos(), "Bad width in JBIG2 generic bitmap"); > // force a call to gmalloc(-1), which will throw an exception > w = -3; >+ gmallocn(w + 2, sizeof(int)); > } > // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = w > // ---> max codingLine size = w + 1 >@@ -3509,7 +3511,7 @@ void JBIG2Stream::readCodeTableSeg(Guint > val = lowVal; > while (val < highVal) { > if (i == huffTabSize) { >- huffTabSize *= 2; >+ huffTabSize = (SafeInt(huffTabSize) * 2).Int(); > huffTab = (JBIG2HuffmanTable *) > greallocn(huffTab, huffTabSize, sizeof(JBIG2HuffmanTable)); > } >Index: poppler-0.12.0/poppler/JPXStream.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/JPXStream.cc >+++ poppler-0.12.0/poppler/JPXStream.cc >@@ -666,7 +666,7 @@ GBool JPXStream::readBoxes() { > } > palette.bpc = (Guint *)gmallocn(palette.nComps, sizeof(Guint)); > palette.c = >- (int *)gmallocn(palette.nEntries * palette.nComps, sizeof(int)); >+ (int *)gmallocn(SafeInt(palette.nEntries) * SafeInt(palette.nComps), sizeof(int)); > for (i = 0; i < palette.nComps; ++i) { > if (!readUByte(&palette.bpc[i])) { > error(getPos(), "Unexpected EOF in JPX stream"); >@@ -924,7 +924,7 @@ GBool JPXStream::readCodestream(Guint le > error(getPos(), "Bad tile count in JPX SIZ marker segment"); > return gFalse; > } >- img.tiles = (JPXTile *)gmallocn(img.nXTiles * img.nYTiles, >+ img.tiles = (JPXTile *)gmallocn(SafeInt(img.nXTiles) * SafeInt(img.nYTiles), > sizeof(JPXTile)); > for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { > img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps, >@@ -992,7 +992,7 @@ GBool JPXStream::readCodestream(Guint le > } > img.tiles[i].tileComps[comp].resLevels = > (JPXResLevel *)gmallocn( >- (img.tiles[i].tileComps[comp].nDecompLevels + 1), >+ (SafeInt(img.tiles[i].tileComps[comp].nDecompLevels) + SafeInt(1)), > sizeof(JPXResLevel)); > for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) { > img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL; >@@ -1069,7 +1069,7 @@ GBool JPXStream::readCodestream(Guint le > img.tiles[i].tileComps[comp].resLevels = > (JPXResLevel *)greallocn( > img.tiles[i].tileComps[comp].resLevels, >- (img.tiles[i].tileComps[comp].nDecompLevels + 1), >+ (SafeInt(img.tiles[i].tileComps[comp].nDecompLevels) + SafeInt(1)), > sizeof(JPXResLevel)); > for (r = 0; r <= img.tiles[i].tileComps[comp].nDecompLevels; ++r) { > img.tiles[i].tileComps[comp].resLevels[r].precincts = NULL; >@@ -1471,7 +1471,7 @@ GBool JPXStream::readTilePart() { > img.tiles[tileIdx].tileComps[comp].resLevels = > (JPXResLevel *)greallocn( > img.tiles[tileIdx].tileComps[comp].resLevels, >- (img.tiles[tileIdx].tileComps[comp].nDecompLevels + 1), >+ (SafeInt(img.tiles[tileIdx].tileComps[comp].nDecompLevels) + SafeInt(1)), > sizeof(JPXResLevel)); > for (r = 0; > r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels; >@@ -1526,7 +1526,7 @@ GBool JPXStream::readTilePart() { > img.tiles[tileIdx].tileComps[comp].resLevels = > (JPXResLevel *)greallocn( > img.tiles[tileIdx].tileComps[comp].resLevels, >- (img.tiles[tileIdx].tileComps[comp].nDecompLevels + 1), >+ (SafeInt(img.tiles[tileIdx].tileComps[comp].nDecompLevels) + SafeInt(1)), > sizeof(JPXResLevel)); > for (r = 0; r <= img.tiles[tileIdx].tileComps[comp].nDecompLevels; ++r) { > img.tiles[tileIdx].tileComps[comp].resLevels[r].precincts = NULL; >@@ -1789,15 +1789,15 @@ GBool JPXStream::readTilePart() { > tileComp->y1 = jpxCeilDiv(tile->y1, tileComp->hSep); > tileComp->cbW = 1 << tileComp->codeBlockW; > tileComp->cbH = 1 << tileComp->codeBlockH; >- tileComp->data = (int *)gmallocn((tileComp->x1 - tileComp->x0) * >- (tileComp->y1 - tileComp->y0), >+ tileComp->data = (int *)gmallocn((SafeInt(tileComp->x1) - SafeInt(tileComp->x0)) * >+ (SafeInt(tileComp->y1) - SafeInt(tileComp->y0)), > sizeof(int)); > if (tileComp->x1 - tileComp->x0 > tileComp->y1 - tileComp->y0) { > n = tileComp->x1 - tileComp->x0; > } else { > n = tileComp->y1 - tileComp->y0; > } >- tileComp->buf = (int *)gmallocn(n + 8, sizeof(int)); >+ tileComp->buf = (int *)gmallocn(SafeInt(n) + SafeInt(8), sizeof(int)); > for (r = 0; r <= tileComp->nDecompLevels; ++r) { > resLevel = &tileComp->resLevels[r]; > k = r == 0 ? tileComp->nDecompLevels >@@ -1858,7 +1858,7 @@ GBool JPXStream::readTilePart() { > for (level = subband->maxTTLevel; level >= 0; --level) { > nx = jpxCeilDivPow2(subband->nXCBs, level); > ny = jpxCeilDivPow2(subband->nYCBs, level); >- n += nx * ny; >+ n += (SafeInt(nx) * SafeInt(ny)).Int(); > } > subband->inclusion = > (JPXTagTreeNode *)gmallocn(n, sizeof(JPXTagTreeNode)); >@@ -1870,8 +1870,8 @@ GBool JPXStream::readTilePart() { > subband->zeroBitPlane[k].finished = gFalse; > subband->zeroBitPlane[k].val = 0; > } >- subband->cbs = (JPXCodeBlock *)gmallocn(subband->nXCBs * >- subband->nYCBs, >+ subband->cbs = (JPXCodeBlock *)gmallocn(SafeInt(subband->nXCBs) * >+ SafeInt(subband->nYCBs), > sizeof(JPXCodeBlock)); > sbx0 = jpxFloorDivPow2(subband->x0, tileComp->codeBlockW); > sby0 = jpxFloorDivPow2(subband->y0, tileComp->codeBlockH); >@@ -1899,8 +1899,8 @@ GBool JPXStream::readTilePart() { > cb->nextPass = jpxPassCleanup; > cb->nZeroBitPlanes = 0; > cb->coeffs = >- (JPXCoeff *)gmallocn((1 << (tileComp->codeBlockW >- + tileComp->codeBlockH)), >+ (JPXCoeff *)gmallocn((SafeInt(1) << (SafeInt(tileComp->codeBlockW) >+ + SafeInt(tileComp->codeBlockH)).Int()), > sizeof(JPXCoeff)); > for (cbi = 0; > cbi < (Guint)(1 << (tileComp->codeBlockW >Index: poppler-0.12.0/poppler/Link.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Link.cc >+++ poppler-0.12.0/poppler/Link.cc >@@ -861,7 +861,7 @@ Link::~Link() { > Links::Links(Object *annots, GooString *baseURI) { > Link *link; > Object obj1, obj2; >- int size; >+ SafeInt size; > int i; > > links = NULL; >Index: poppler-0.12.0/poppler/NameToCharCode.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/NameToCharCode.cc >+++ poppler-0.12.0/poppler/NameToCharCode.cc >@@ -49,7 +49,8 @@ NameToCharCode::~NameToCharCode() { > > void NameToCharCode::add(char *name, CharCode c) { > NameToCharCodeEntry *oldTab; >- int h, i, oldSize; >+ int h, i; >+ SafeInt oldSize; > > // expand the table if necessary > if (len >= size / 2) { >@@ -112,5 +113,5 @@ int NameToCharCode::hash(char *name) { > for (p = name; *p; ++p) { > h = 17 * h + (int)(*p & 0xff); > } >- return (int)(h % size); >+ return (int)(h % size.Int()); > } >Index: poppler-0.12.0/poppler/NameToCharCode.h >=================================================================== >--- poppler-0.12.0.orig/poppler/NameToCharCode.h >+++ poppler-0.12.0/poppler/NameToCharCode.h >@@ -33,7 +33,7 @@ private: > int hash(char *name); > > NameToCharCodeEntry *tab; >- int size; >+ SafeInt size; > int len; > }; > >Index: poppler-0.12.0/poppler/PSOutputDev.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/PSOutputDev.cc >+++ poppler-0.12.0/poppler/PSOutputDev.cc >@@ -2321,11 +2321,11 @@ GooString *PSOutputDev::setupExternalCID > if (fontFileNameLen >= fontFileNameSize) { > fontFileNameSize += 64; > fontFileNames = >- (GooString **)grealloc(fontFileNames, >- fontFileNameSize * sizeof(GooString *)); >+ (GooString **)greallocn(fontFileNames, >+ fontFileNameSize, sizeof(GooString *)); > psFileNames = >- (GooString **)grealloc(psFileNames, >- fontFileNameSize * sizeof(GooString *)); >+ (GooString **)greallocn(psFileNames, >+ fontFileNameSize, sizeof(GooString *)); > } > } > fontFileNames[fontFileNameLen] = myFileName; >@@ -4775,7 +4775,8 @@ void PSOutputDev::doImageL2(Object *ref, > ImageStream *imgStr; > Guchar *line; > PSOutImgClipRect *rects0, *rects1, *rectsTmp, *rectsOut; >- int rects0Len, rects1Len, rectsSize, rectsOutLen, rectsOutSize; >+ int rects0Len, rects1Len, rectsOutLen; >+ SafeInt rectsOutSize, rectsSize; > GBool emitRect, addRect, extendRect; > GooString *s; > int n, numComps; >Index: poppler-0.12.0/poppler/PSOutputDev.h >=================================================================== >--- poppler-0.12.0.orig/poppler/PSOutputDev.h >+++ poppler-0.12.0/poppler/PSOutputDev.h >@@ -378,10 +378,10 @@ private: > > Ref *fontIDs; // list of object IDs of all used fonts > int fontIDLen; // number of entries in fontIDs array >- int fontIDSize; // size of fontIDs array >+ SafeInt fontIDSize; // size of fontIDs array > Ref *fontFileIDs; // list of object IDs of all embedded fonts > int fontFileIDLen; // number of entries in fontFileIDs array >- int fontFileIDSize; // size of fontFileIDs array >+ SafeInt fontFileIDSize; // size of fontFileIDs array > GooString **fontFileNames; // list of names of all embedded external fonts > GooString **psFileNames; // list of names of all embedded external fonts > int fontFileNameLen; // number of entries in fontFileNames array >@@ -390,16 +390,16 @@ private: > // font name > PSFont8Info *font8Info; // info for 8-bit fonts > int font8InfoLen; // number of entries in font8Info array >- int font8InfoSize; // size of font8Info array >+ SafeInt font8InfoSize; // size of font8Info array > PSFont16Enc *font16Enc; // encodings for substitute 16-bit fonts > int font16EncLen; // number of entries in font16Enc array >- int font16EncSize; // size of font16Enc array >+ SafeInt font16EncSize; // size of font16Enc array > Ref *imgIDs; // list of image IDs for in-memory images > int imgIDLen; // number of entries in imgIDs array >- int imgIDSize; // size of imgIDs array >+ SafeInt imgIDSize; // size of imgIDs array > Ref *formIDs; // list of IDs for predefined forms > int formIDLen; // number of entries in formIDs array >- int formIDSize; // size of formIDs array >+ SafeInt formIDSize; // size of formIDs array > GooList *xobjStack; // stack of XObject dicts currently being > // processed > int numSaves; // current number of gsaves >Index: poppler-0.12.0/poppler/SplashOutputDev.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/SplashOutputDev.cc >+++ poppler-0.12.0/poppler/SplashOutputDev.cc >@@ -707,8 +707,8 @@ public: > int glyphW, glyphH; // size of glyph bitmaps, in pixels > GBool validBBox; // false if the bbox was [0 0 0 0] > int glyphSize; // size of glyph bitmaps, in bytes >- int cacheSets; // number of sets in cache >- int cacheAssoc; // cache associativity (glyphs per set) >+ SafeInt cacheSets; // number of sets in cache >+ SafeInt cacheAssoc; // cache associativity (glyphs per set) > Guchar *cacheData; // glyph pixmap cache > T3FontCacheTag *cacheTags; // cache tags, i.e., char codes > }; >@@ -765,7 +765,7 @@ T3FontCache::T3FontCache(Ref *fontIDA, d > cacheTags = (T3FontCacheTag *)gmallocn(cacheSets * cacheAssoc, > sizeof(T3FontCacheTag)); > for (i = 0; i < cacheSets * cacheAssoc; ++i) { >- cacheTags[i].mru = i & (cacheAssoc - 1); >+ cacheTags[i].mru = i & (cacheAssoc.Int() - 1); > } > } > else >@@ -1741,7 +1741,7 @@ GBool SplashOutputDev::beginType3Char(Gf > t3Font = t3FontCache[0]; > > // is the glyph in the cache? >- i = (code & (t3Font->cacheSets - 1)) * t3Font->cacheAssoc; >+ i = (code & (t3Font->cacheSets.Int() - 1)) * t3Font->cacheAssoc.Int(); > for (j = 0; j < t3Font->cacheAssoc; ++j) { > if (t3Font->cacheTags != NULL) { > if ((t3Font->cacheTags[i+j].mru & 0x8000) && >@@ -1853,7 +1853,7 @@ void SplashOutputDev::type3D1(GfxState * > return; > > // allocate a cache entry >- i = (t3GlyphStack->code & (t3Font->cacheSets - 1)) * t3Font->cacheAssoc; >+ i = (t3GlyphStack->code & (t3Font->cacheSets.Int() - 1)) * t3Font->cacheAssoc.Int(); > for (j = 0; j < t3Font->cacheAssoc; ++j) { > if ((t3Font->cacheTags[i+j].mru & 0x7fff) == t3Font->cacheAssoc - 1) { > t3Font->cacheTags[i+j].mru = 0x8000; >@@ -2282,7 +2282,7 @@ void SplashOutputDev::drawImage(GfxState > // build a lookup table here > imgData.lookup = NULL; > if (colorMap->getNumPixelComps() == 1) { >- n = 1 << colorMap->getBits(); >+ n = (SafeInt(1) << colorMap->getBits()).Int(); > switch (colorMode) { > case splashModeMono1: > case splashModeMono8: >@@ -2549,7 +2549,7 @@ void SplashOutputDev::drawMaskedImage(Gf > // build a lookup table here > imgData.lookup = NULL; > if (colorMap->getNumPixelComps() == 1) { >- n = 1 << colorMap->getBits(); >+ n = (SafeInt(1) << colorMap->getBits()).Int(); > switch (colorMode) { > case splashModeMono1: > case splashModeMono8: >@@ -2657,7 +2657,7 @@ void SplashOutputDev::drawSoftMaskedImag > imgMaskData.width = maskWidth; > imgMaskData.height = maskHeight; > imgMaskData.y = 0; >- n = 1 << maskColorMap->getBits(); >+ n = (SafeInt(1) << maskColorMap->getBits()).Int(); > imgMaskData.lookup = (SplashColorPtr)gmalloc(n); > for (i = 0; i < n; ++i) { > pix = (Guchar)i; >@@ -2694,7 +2694,7 @@ void SplashOutputDev::drawSoftMaskedImag > // build a lookup table here > imgData.lookup = NULL; > if (colorMap->getNumPixelComps() == 1) { >- n = 1 << colorMap->getBits(); >+ n = (SafeInt(1) << maskColorMap->getBits()).Int(); > switch (colorMode) { > case splashModeMono1: > case splashModeMono8: >Index: poppler-0.12.0/poppler/Stream.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/Stream.cc >+++ poppler-0.12.0/poppler/Stream.cc >@@ -400,7 +400,7 @@ ImageStream::ImageStream(Stream *strA, i > > nVals = width * nComps; > if (nBits == 1) { >- imgLineSize = (nVals + 7) & ~7; >+ imgLineSize = (SafeInt(nVals) + SafeInt(7)).Int() & ~7; > } else { > imgLineSize = nVals; > } >@@ -1352,8 +1352,8 @@ CCITTFaxStream::CCITTFaxStream(Stream *s > // ---> max codingLine size = columns + 1 > // refLine has one extra guard entry at the end > // ---> max refLine size = columns + 2 >- codingLine = (int *)gmallocn_checkoverflow(columns + 1, sizeof(int)); >- refLine = (int *)gmallocn_checkoverflow(columns + 2, sizeof(int)); >+ codingLine = (int *)gmallocn_checkoverflow(SafeInt(columns) + SafeInt(1), sizeof(int)); >+ refLine = (int *)gmallocn_checkoverflow(SafeInt(columns) + SafeInt(2), sizeof(int)); > > if (codingLine != NULL && refLine != NULL) { > eof = gFalse; >@@ -2089,7 +2089,7 @@ void DCTStream::reset() { > unfilteredReset(); > > if (!readHeader()) { >- y = height; >+ y = height.Int(); > return; > } > >@@ -2134,12 +2134,12 @@ void DCTStream::reset() { > if (bufWidth <= 0 || bufHeight <= 0 || > bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { > error(getPos(), "Invalid image size in DCT stream"); >- y = height; >+ y = height.Int(); > return; > } > for (i = 0; i < numComps; ++i) { > frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int)); >- memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int)); >+ memset(frameBuf[i], 0, (bufWidth * bufHeight * sizeof(int)).Int()); > } > > // read the image data >@@ -2171,7 +2171,7 @@ void DCTStream::reset() { > comp = 0; > x = 0; > y = 0; >- dy = mcuHeight; >+ dy = mcuHeight.Int(); > > restartMarker = 0xd0; > restart(); >@@ -2199,7 +2199,7 @@ int DCTStream::getChar() { > return EOF; > } > if (progressive || !interleaved) { >- c = frameBuf[comp][y * bufWidth + x]; >+ c = frameBuf[comp][y * bufWidth.Int() + x]; > if (++comp == numComps) { > comp = 0; > if (++x == width) { >@@ -2210,7 +2210,7 @@ int DCTStream::getChar() { > } else { > if (dy >= mcuHeight) { > if (!readMCURow()) { >- y = height; >+ y = height.Int(); > return EOF; > } > comp = 0; >@@ -2238,11 +2238,11 @@ int DCTStream::lookChar() { > return EOF; > } > if (progressive || !interleaved) { >- return frameBuf[comp][y * bufWidth + x]; >+ return frameBuf[comp][y * bufWidth.Int() + x]; > } else { > if (dy >= mcuHeight) { > if (!readMCURow()) { >- y = height; >+ y = height.Int(); > return EOF; > } > comp = 0; >@@ -2274,7 +2274,7 @@ GBool DCTStream::readMCURow() { > int x1, x2, y2, x3, y3, x4, y4, x5, y5, cc, i; > int c; > >- for (x1 = 0; x1 < width; x1 += mcuWidth) { >+ for (x1 = 0; x1 < width; x1 += mcuWidth.Int()) { > > // deal with restart marker > if (restartInterval > 0 && restartCtr == 0) { >@@ -2292,8 +2292,8 @@ GBool DCTStream::readMCURow() { > for (cc = 0; cc < numComps; ++cc) { > h = compInfo[cc].hSample; > v = compInfo[cc].vSample; >- horiz = mcuWidth / h; >- vert = mcuHeight / v; >+ horiz = mcuWidth.Int() / h; >+ vert = mcuHeight.Int() / v; > hSub = horiz / 8; > vSub = vert / 8; > for (y2 = 0; y2 < mcuHeight; y2 += vert) { >@@ -2399,11 +2399,11 @@ void DCTStream::readScan() { > break; > } > } >- dx1 = mcuWidth / compInfo[cc].hSample; >- dy1 = mcuHeight / compInfo[cc].vSample; >+ dx1 = mcuWidth.Int() / compInfo[cc].hSample; >+ dy1 = mcuHeight.Int() / compInfo[cc].vSample; > } else { >- dx1 = mcuWidth; >- dy1 = mcuHeight; >+ dx1 = mcuWidth.Int(); >+ dy1 = mcuHeight.Int(); > } > > for (y1 = 0; y1 < height; y1 += dy1) { >@@ -2430,14 +2430,14 @@ void DCTStream::readScan() { > > h = compInfo[cc].hSample; > v = compInfo[cc].vSample; >- horiz = mcuWidth / h; >- vert = mcuHeight / v; >+ horiz = mcuWidth.Int() / h; >+ vert = mcuHeight.Int() / v; > vSub = vert / 8; > for (y2 = 0; y2 < dy1; y2 += vert) { > for (x2 = 0; x2 < dx1; x2 += horiz) { > > // pull out the current values >- p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)]; >+ p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)]; > for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) { > data[i] = p1[0]; > data[i+1] = p1[1]; >@@ -2447,7 +2447,7 @@ void DCTStream::readScan() { > data[i+5] = p1[5]; > data[i+6] = p1[6]; > data[i+7] = p1[7]; >- p1 += bufWidth * vSub; >+ p1 += bufWidth.Int() * vSub; > } > > // read one data unit >@@ -2469,7 +2469,7 @@ void DCTStream::readScan() { > } > > // add the data unit into frameBuf >- p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)]; >+ p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)]; > for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) { > p1[0] = data[i]; > p1[1] = data[i+1]; >@@ -2479,7 +2479,7 @@ void DCTStream::readScan() { > p1[5] = data[i+5]; > p1[6] = data[i+6]; > p1[7] = data[i+7]; >- p1 += bufWidth * vSub; >+ p1 += bufWidth.Int() * vSub; > } > } > } >@@ -2676,21 +2676,21 @@ void DCTStream::decodeImage() { > int h, v, horiz, vert, hSub, vSub; > int *p0, *p1, *p2; > >- for (y1 = 0; y1 < bufHeight; y1 += mcuHeight) { >- for (x1 = 0; x1 < bufWidth; x1 += mcuWidth) { >+ for (y1 = 0; y1 < bufHeight; y1 += mcuHeight.Int()) { >+ for (x1 = 0; x1 < bufWidth; x1 += mcuWidth.Int()) { > for (cc = 0; cc < numComps; ++cc) { > quantTable = quantTables[compInfo[cc].quantTable]; > h = compInfo[cc].hSample; > v = compInfo[cc].vSample; >- horiz = mcuWidth / h; >- vert = mcuHeight / v; >+ horiz = mcuWidth.Int() / h; >+ vert = mcuHeight.Int() / v; > hSub = horiz / 8; > vSub = vert / 8; > for (y2 = 0; y2 < mcuHeight; y2 += vert) { > for (x2 = 0; x2 < mcuWidth; x2 += horiz) { > > // pull out the coded data unit >- p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)]; >+ p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)]; > for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) { > dataIn[i] = p1[0]; > dataIn[i+1] = p1[1]; >@@ -2700,7 +2700,7 @@ void DCTStream::decodeImage() { > dataIn[i+5] = p1[5]; > dataIn[i+6] = p1[6]; > dataIn[i+7] = p1[7]; >- p1 += bufWidth * vSub; >+ p1 += bufWidth.Int() * vSub; > } > > // transform >@@ -2708,7 +2708,7 @@ void DCTStream::decodeImage() { > > // store back into frameBuf, doing replication for > // subsampled components >- p1 = &frameBuf[cc][(y1+y2) * bufWidth + (x1+x2)]; >+ p1 = &frameBuf[cc][(y1+y2) * bufWidth.Int() + (x1+x2)]; > if (hSub == 1 && vSub == 1) { > for (y3 = 0, i = 0; y3 < 8; ++y3, i += 8) { > p1[0] = dataOut[i] & 0xff; >@@ -2719,10 +2719,10 @@ void DCTStream::decodeImage() { > p1[5] = dataOut[i+5] & 0xff; > p1[6] = dataOut[i+6] & 0xff; > p1[7] = dataOut[i+7] & 0xff; >- p1 += bufWidth; >+ p1 += bufWidth.Int(); > } > } else if (hSub == 2 && vSub == 2) { >- p2 = p1 + bufWidth; >+ p2 = p1 + bufWidth.Int(); > for (y3 = 0, i = 0; y3 < 16; y3 += 2, i += 8) { > p1[0] = p1[1] = p2[0] = p2[1] = dataOut[i] & 0xff; > p1[2] = p1[3] = p2[2] = p2[3] = dataOut[i+1] & 0xff; >@@ -2732,8 +2732,8 @@ void DCTStream::decodeImage() { > p1[10] = p1[11] = p2[10] = p2[11] = dataOut[i+5] & 0xff; > p1[12] = p1[13] = p2[12] = p2[13] = dataOut[i+6] & 0xff; > p1[14] = p1[15] = p2[14] = p2[15] = dataOut[i+7] & 0xff; >- p1 += bufWidth * 2; >- p2 += bufWidth * 2; >+ p1 += bufWidth.Int() * 2; >+ p2 += bufWidth.Int() * 2; > } > } else { > i = 0; >@@ -2744,11 +2744,11 @@ void DCTStream::decodeImage() { > for (x5 = 0; x5 < hSub; ++x5) { > p2[x5] = dataOut[i] & 0xff; > } >- p2 += bufWidth; >+ p2 += bufWidth.Int(); > } > ++i; > } >- p1 += bufWidth * vSub; >+ p1 += bufWidth.Int() * vSub; > } > } > } >@@ -2760,9 +2760,9 @@ void DCTStream::decodeImage() { > // convert YCbCr to RGB > if (numComps == 3) { > for (y2 = 0; y2 < mcuHeight; ++y2) { >- p0 = &frameBuf[0][(y1+y2) * bufWidth + x1]; >- p1 = &frameBuf[1][(y1+y2) * bufWidth + x1]; >- p2 = &frameBuf[2][(y1+y2) * bufWidth + x1]; >+ p0 = &frameBuf[0][(y1+y2) * bufWidth.Int() + x1]; >+ p1 = &frameBuf[1][(y1+y2) * bufWidth.Int() + x1]; >+ p2 = &frameBuf[2][(y1+y2) * bufWidth.Int() + x1]; > for (x2 = 0; x2 < mcuWidth; ++x2) { > pY = *p0; > pCb = *p1 - 128; >@@ -2779,9 +2779,9 @@ void DCTStream::decodeImage() { > // convert YCbCrK to CMYK (K is passed through unchanged) > } else if (numComps == 4) { > for (y2 = 0; y2 < mcuHeight; ++y2) { >- p0 = &frameBuf[0][(y1+y2) * bufWidth + x1]; >- p1 = &frameBuf[1][(y1+y2) * bufWidth + x1]; >- p2 = &frameBuf[2][(y1+y2) * bufWidth + x1]; >+ p0 = &frameBuf[0][(y1+y2) * bufWidth.Int() + x1]; >+ p1 = &frameBuf[1][(y1+y2) * bufWidth.Int() + x1]; >+ p2 = &frameBuf[2][(y1+y2) * bufWidth.Int() + x1]; > for (x2 = 0; x2 < mcuWidth; ++x2) { > pY = *p0; > pCb = *p1 - 128; >@@ -4443,7 +4443,7 @@ void FlateStream::compHuffmanCodes(int * > } > > // allocate the table >- tabSize = 1 << tab->maxLen; >+ tabSize = (SafeInt(1) << tab->maxLen).Int(); > tab->codes = (FlateCode *)gmallocn(tabSize, sizeof(FlateCode)); > > // clear the table >Index: poppler-0.12.0/poppler/Stream.h >=================================================================== >--- poppler-0.12.0.orig/poppler/Stream.h >+++ poppler-0.12.0/poppler/Stream.h >@@ -699,9 +699,9 @@ private: > > GBool progressive; // set if in progressive mode > GBool interleaved; // set if in interleaved mode >- int width, height; // image size >- int mcuWidth, mcuHeight; // size of min coding unit, in data units >- int bufWidth, bufHeight; // frameBuf size >+ SafeInt width, height; // image size >+ SafeInt mcuWidth, mcuHeight; // size of min coding unit, in data units >+ SafeInt bufWidth, bufHeight; // frameBuf size > DCTCompInfo compInfo[4]; // info for each component > DCTScanInfo scanInfo; // info for the current scan > int numComps; // number of components in image >Index: poppler-0.12.0/poppler/TextOutputDev.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/TextOutputDev.cc >+++ poppler-0.12.0/poppler/TextOutputDev.cc >@@ -290,7 +290,7 @@ TextWord::TextWord(GfxState *state, int > text = NULL; > charcode = NULL; > edge = NULL; >- len = size = 0; >+ size = len = 0; > spaceAfter = gFalse; > next = NULL; > >@@ -376,10 +376,10 @@ void TextWord::merge(TextWord *word) { > yMax = word->yMax; > } > if (len + word->len > size) { >- size = len + word->len; >+ size = SafeInt(len) + SafeInt(word->len); > text = (Unicode *)greallocn(text, size, sizeof(Unicode)); > charcode = (CharCode *)greallocn(charcode, (size + 1), sizeof(CharCode)); >- edge = (double *)greallocn(edge, (size + 1), sizeof(double)); >+ edge = (double *)greallocn(edge, (size + SafeInt(1)), sizeof(double)); > } > for (i = 0; i < word->len; ++i) { > text[len + i] = word->text[i]; >@@ -513,11 +513,11 @@ TextPool::TextPool() { > } > > TextPool::~TextPool() { >- int baseIdx; >+ SafeInt baseIdx; > TextWord *word, *word2; > > for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) { >- for (word = pool[baseIdx - minBaseIdx]; word; word = word2) { >+ for (word = pool[(baseIdx - minBaseIdx).Int()]; word; word = word2) { > word2 = word->next; > delete word; > } >@@ -530,17 +530,17 @@ int TextPool::getBaseIdx(double base) { > > baseIdx = (int)(base / textPoolStep); > if (baseIdx < minBaseIdx) { >- return minBaseIdx; >+ return minBaseIdx.Int(); > } > if (baseIdx > maxBaseIdx) { >- return maxBaseIdx; >+ return maxBaseIdx.Int(); > } > return baseIdx; > } > > void TextPool::addWord(TextWord *word) { > TextWord **newPool; >- int wordBaseIdx, newMinBaseIdx, newMaxBaseIdx, baseIdx; >+ SafeInt wordBaseIdx, newMinBaseIdx, newMaxBaseIdx, baseIdx; > TextWord *w0, *w1; > > // expand the array if needed >@@ -548,29 +548,29 @@ void TextPool::addWord(TextWord *word) { > if (minBaseIdx > maxBaseIdx) { > minBaseIdx = wordBaseIdx - 128; > maxBaseIdx = wordBaseIdx + 128; >- pool = (TextWord **)gmallocn(maxBaseIdx - minBaseIdx + 1, >+ pool = (TextWord **)gmallocn(maxBaseIdx - minBaseIdx + SafeInt(1), > sizeof(TextWord *)); > for (baseIdx = minBaseIdx; baseIdx <= maxBaseIdx; ++baseIdx) { >- pool[baseIdx - minBaseIdx] = NULL; >+ pool[(baseIdx - minBaseIdx).Int()] = NULL; > } > } else if (wordBaseIdx < minBaseIdx) { > newMinBaseIdx = wordBaseIdx - 128; >- newPool = (TextWord **)gmallocn(maxBaseIdx - newMinBaseIdx + 1, >+ newPool = (TextWord **)gmallocn(maxBaseIdx - newMinBaseIdx + SafeInt(1), > sizeof(TextWord *)); > for (baseIdx = newMinBaseIdx; baseIdx < minBaseIdx; ++baseIdx) { >- newPool[baseIdx - newMinBaseIdx] = NULL; >+ newPool[(baseIdx - newMinBaseIdx).Int()] = NULL; > } >- memcpy(&newPool[minBaseIdx - newMinBaseIdx], pool, >- (maxBaseIdx - minBaseIdx + 1) * sizeof(TextWord *)); >+ memcpy(&newPool[(minBaseIdx - newMinBaseIdx).Int()], pool, >+ ((maxBaseIdx - minBaseIdx + 1) * sizeof(TextWord *)).Int()); > gfree(pool); > pool = newPool; > minBaseIdx = newMinBaseIdx; > } else if (wordBaseIdx > maxBaseIdx) { > newMaxBaseIdx = wordBaseIdx + 128; >- pool = (TextWord **)greallocn(pool, newMaxBaseIdx - minBaseIdx + 1, >+ pool = (TextWord **)greallocn(pool, newMaxBaseIdx - minBaseIdx + SafeInt(1), > sizeof(TextWord *)); > for (baseIdx = maxBaseIdx + 1; baseIdx <= newMaxBaseIdx; ++baseIdx) { >- pool[baseIdx - minBaseIdx] = NULL; >+ pool[(baseIdx - minBaseIdx).Int()] = NULL; > } > maxBaseIdx = newMaxBaseIdx; > } >@@ -582,17 +582,17 @@ void TextPool::addWord(TextWord *word) { > w1 = cursor->next; > } else { > w0 = NULL; >- w1 = pool[wordBaseIdx - minBaseIdx]; >+ w1 = pool[(wordBaseIdx - minBaseIdx).Int()]; > } > for (; w1 && word->primaryCmp(w1) > 0; w0 = w1, w1 = w1->next) ; > word->next = w1; > if (w0) { > w0->next = word; > } else { >- pool[wordBaseIdx - minBaseIdx] = word; >+ pool[(wordBaseIdx - minBaseIdx).Int()] = word; > } > cursor = word; >- cursorBaseIdx = wordBaseIdx; >+ cursorBaseIdx = wordBaseIdx.Int(); > } > > //------------------------------------------------------------------------ >@@ -802,7 +802,7 @@ void TextLine::coalesce(UnicodeMap *uMap > } > } > text = (Unicode *)gmallocn(len, sizeof(Unicode)); >- edge = (double *)gmallocn(len + 1, sizeof(double)); >+ edge = (double *)gmallocn(len + SafeInt(1), sizeof(double)); > i = 0; > for (word1 = words; word1; word1 = word1->next) { > for (j = 0; j < word1->len; ++j) { >@@ -818,7 +818,7 @@ void TextLine::coalesce(UnicodeMap *uMap > } > > // compute convertedLen and set up the col array >- col = (int *)gmallocn(len + 1, sizeof(int)); >+ col = (int *)gmallocn(len + SafeInt(1), sizeof(int)); > convertedLen = 0; > for (i = 0; i < len; ++i) { > col[i] = convertedLen; >@@ -828,11 +828,11 @@ void TextLine::coalesce(UnicodeMap *uMap > convertedLen += uMap->mapUnicode(text[i], buf, sizeof(buf)); > } > } >- col[len] = convertedLen; >+ col[len.Int()] = convertedLen; > > // check for hyphen at end of line > //~ need to check for other chars used as hyphens >- hyphenated = text[len - 1] == (Unicode)'-'; >+ hyphenated = text[(len - 1).Int()] == (Unicode)'-'; > } > > //------------------------------------------------------------------------ >@@ -1202,7 +1202,7 @@ void TextBlock::coalesce(UnicodeMap *uMa > int i, j, k; > > // discard duplicated text (fake boldface, drop shadows) >- for (idx0 = pool->minBaseIdx; idx0 <= pool->maxBaseIdx; ++idx0) { >+ for (idx0 = pool->minBaseIdx.Int(); idx0 <= pool->maxBaseIdx.Int(); ++idx0) { > word0 = pool->getPool(idx0); > while (word0) { > priDelta = dupMaxPriDelta * word0->fontSize; >@@ -1266,7 +1266,7 @@ void TextBlock::coalesce(UnicodeMap *uMa > > // build the lines > curLine = NULL; >- poolMinBaseIdx = pool->minBaseIdx; >+ poolMinBaseIdx = pool->minBaseIdx.Int(); > charCount = 0; > nLines = 0; > while (1) { >@@ -1368,7 +1368,7 @@ void TextBlock::coalesce(UnicodeMap *uMa > line->next = line1; > curLine = line; > line->coalesce(uMap); >- charCount += line->len; >+ charCount += line->len.Int(); > ++nLines; > } > >@@ -1377,7 +1377,7 @@ void TextBlock::coalesce(UnicodeMap *uMa > for (line = lines, i = 0; line; line = line->next, ++i) { > lineArray[i] = line; > } >- qsort(lineArray, nLines, sizeof(TextLine *), &TextLine::cmpXY); >+ qsort(lineArray, nLines.Int(), sizeof(TextLine *), &TextLine::cmpXY); > > // column assignment > nColumns = 0; >@@ -1387,7 +1387,7 @@ void TextBlock::coalesce(UnicodeMap *uMa > for (j = 0; j < i; ++j) { > line1 = lineArray[j]; > if (line1->primaryDelta(line0) >= 0) { >- col2 = line1->col[line1->len] + 1; >+ col2 = line1->col[line1->len.Int()] + 1; > } else { > k = 0; // make gcc happy > switch (rot) { >@@ -1425,8 +1425,8 @@ void TextBlock::coalesce(UnicodeMap *uMa > for (k = 0; k <= line0->len; ++k) { > line0->col[k] += col1; > } >- if (line0->col[line0->len] > nColumns) { >- nColumns = line0->col[line0->len]; >+ if (line0->col[line0->len.Int()] > nColumns) { >+ nColumns = line0->col[line0->len.Int()]; > } > } > gfree(lineArray); >@@ -1699,7 +1699,8 @@ TextWordList::TextWordList(TextPage *tex > TextLine *line; > TextWord *word; > TextWord **wordArray; >- int nWords, i; >+ SafeInt nWords; >+ int i; > > words = new GooList(); > >@@ -1732,7 +1733,7 @@ TextWordList::TextWordList(TextPage *tex > } > } > } >- qsort(wordArray, nWords, sizeof(TextWord *), &TextWord::cmpYX); >+ qsort(wordArray, nWords.Int(), sizeof(TextWord *), &TextWord::cmpYX); > for (i = 0; i < nWords; ++i) { > words->append(wordArray[i]); > } >@@ -2193,7 +2194,8 @@ void TextPage::coalesce(GBool physLayout > GBool found; > int count[4]; > int lrCount; >- int firstBlkIdx, nBlocksLeft; >+ int firstBlkIdx; >+ SafeInt nBlocksLeft; > int col1, col2; > int i, j, n; > >@@ -2379,7 +2381,7 @@ void TextPage::coalesce(GBool physLayout > // build blocks for each rotation value > for (rot = 0; rot < 4; ++rot) { > pool = pools[rot]; >- poolMinBaseIdx = pool->minBaseIdx; >+ poolMinBaseIdx = pool->minBaseIdx.Int(); > count[rot] = 0; > > // add blocks until no more words are left >@@ -2749,7 +2751,7 @@ void TextPage::coalesce(GBool physLayout > for (blk = blkList, i = 0; blk; blk = blk->next, ++i) { > blocks[i] = blk; > } >- qsort(blocks, nBlocks, sizeof(TextBlock *), &TextBlock::cmpXYPrimaryRot); >+ qsort(blocks, nBlocks.Int(), sizeof(TextBlock *), &TextBlock::cmpXYPrimaryRot); > > // column assignment > for (i = 0; i < nBlocks; ++i) { >@@ -2841,7 +2843,7 @@ void TextPage::coalesce(GBool physLayout > //----- reading order sort > > // sort blocks into yx order (in preparation for reading order sort) >- qsort(blocks, nBlocks, sizeof(TextBlock *), &TextBlock::cmpYXPrimaryRot); >+ qsort(blocks, nBlocks.Int(), sizeof(TextBlock *), &TextBlock::cmpYXPrimaryRot); > > // compute space on left and right sides of each block > for (i = 0; i < nBlocks; ++i) { >@@ -2881,7 +2883,7 @@ void TextPage::coalesce(GBool physLayout > //~ this needs to be adjusted for writing mode (vertical text) > //~ this also needs to account for right-to-left column ordering > blkArray = (TextBlock **)gmallocn(nBlocks, sizeof(TextBlock *)); >- memcpy(blkArray, blocks, nBlocks * sizeof(TextBlock *)); >+ memcpy(blkArray, blocks, nBlocks.Int() * sizeof(TextBlock *)); > while (flows) { > flow = flows; > flows = flows->next; >@@ -3058,7 +3060,7 @@ GBool TextPage::findText(Unicode *s, int > xMin0 = xMax0 = yMin0 = yMax0 = 0; // make gcc happy > xMin1 = xMax1 = yMin1 = yMax1 = 0; // make gcc happy > >- for (i = backward ? nBlocks - 1 : 0; >+ for (i = backward ? (nBlocks - 1).Int() : 0; > backward ? i >= 0 : i < nBlocks; > i += backward ? -1 : 1) { > blk = blocks[i]; >@@ -3088,7 +3090,7 @@ GBool TextPage::findText(Unicode *s, int > } > > if (!line->normalized) >- line->normalized = unicodeNormalizeNFKC(line->text, line->len, >+ line->normalized = unicodeNormalizeNFKC(line->text, line->len.Int(), > &line->normalized_len, > &line->normalized_idx); > // convert the line to uppercase >@@ -3218,7 +3220,8 @@ GooString *TextPage::getText(double xMin > TextBlock *blk; > TextLine *line; > TextLineFrag *frags; >- int nFrags, fragsSize; >+ int nFrags; >+ SafeInt fragsSize; > TextLineFrag *frag; > char space[8], eol[16]; > int spaceLen, eolLen; >@@ -3281,7 +3284,7 @@ GooString *TextPage::getText(double xMin > } > ++j; > } >- j = line->len - 1; >+ j = (line->len - 1).Int(); > while (j >= 0) { > if (0.5 * (line->edge[j] + line->edge[j+1]) < xMax) { > idx1 = j; >@@ -3302,7 +3305,7 @@ GooString *TextPage::getText(double xMin > } > ++j; > } >- j = line->len - 1; >+ j = (line->len - 1).Int(); > while (j >= 0) { > if (0.5 * (line->edge[j] + line->edge[j+1]) < yMax) { > idx1 = j; >@@ -3323,7 +3326,7 @@ GooString *TextPage::getText(double xMin > } > ++j; > } >- j = line->len - 1; >+ j = (line->len - 1).Int(); > while (j >= 0) { > if (0.5 * (line->edge[j] + line->edge[j+1]) > xMin) { > idx1 = j; >@@ -3344,7 +3347,7 @@ GooString *TextPage::getText(double xMin > } > ++j; > } >- j = line->len - 1; >+ j = (line->len - 1).Int(); > while (j >= 0) { > if (0.5 * (line->edge[j] + line->edge[j+1]) > yMin) { > idx1 = j; >@@ -3833,7 +3836,7 @@ void TextLine::visitSelection(TextSelect > } > } > >- edge_begin = len; >+ edge_begin = len.Int(); > edge_end = 0; > for (i = 0; i < len; i++) { > double mid = (edge[i] + edge[i + 1]) / 2; >@@ -3899,8 +3902,7 @@ void TextBlock::visitSelection(TextSelec > } > > if (((selection->x1 > p->xMin && selection->y1 > p->yMin) || >- (selection->x2 > p->xMin && selection->y2 > p->yMin)) >- && (begin != NULL)) >+ (selection->x2 > p->xMin && selection->y2 > p->yMin)) && (begin != NULL)) > end = p->next; > } > >@@ -3939,7 +3941,7 @@ void TextPage::visitSelection(TextSelect > double start_x, start_y, stop_x, stop_y; > TextBlock *b; > >- begin = nBlocks; >+ begin = nBlocks.Int(); > end = 0; > start_x = selection->x1; > start_y = selection->y1; >@@ -4134,7 +4136,8 @@ void TextPage::dump(void *outputStream, > TextLine *line; > TextLineFrag *frags; > TextWord *word; >- int nFrags, fragsSize; >+ int nFrags; >+ SafeInt fragsSize; > TextLineFrag *frag; > char space[8], eol[16], eop[8]; > int spaceLen, eolLen, eopLen; >@@ -4200,7 +4203,7 @@ void TextPage::dump(void *outputStream, > frags = (TextLineFrag *)greallocn(frags, > fragsSize, sizeof(TextLineFrag)); > } >- frags[nFrags].init(line, 0, line->len); >+ frags[nFrags].init(line, 0, line->len.Int()); > frags[nFrags].computeCoords(gTrue); > ++nFrags; > } >@@ -4277,7 +4280,7 @@ void TextPage::dump(void *outputStream, > for (flow = flows; flow; flow = flow->next) { > for (blk = flow->blocks; blk; blk = blk->next) { > for (line = blk->lines; line; line = line->next) { >- n = line->len; >+ n = line->len.Int(); > if (line->hyphenated && (line->next || blk->next)) { > --n; > } >Index: poppler-0.12.0/poppler/TextOutputDev.h >=================================================================== >--- poppler-0.12.0.orig/poppler/TextOutputDev.h >+++ poppler-0.12.0/poppler/TextOutputDev.h >@@ -176,7 +176,7 @@ private: > double *edge; // "near" edge x or y coord of each char > // (plus one extra entry for the last char) > int len; // length of text and edge arrays >- int size; // size of text and edge arrays >+ SafeInt size; // size of text and edge arrays > int charPos; // character position (within content stream) > int charLen; // number of content stream characters in > // this word >@@ -216,8 +216,8 @@ public: > TextPool(); > ~TextPool(); > >- TextWord *getPool(int baseIdx) { return pool[baseIdx - minBaseIdx]; } >- void setPool(int baseIdx, TextWord *p) { pool[baseIdx - minBaseIdx] = p; } >+ TextWord *getPool(int baseIdx) { return pool[(baseIdx - minBaseIdx).Int()]; } >+ void setPool(int baseIdx, TextWord *p) { pool[(baseIdx - minBaseIdx).Int()] = p; } > > int getBaseIdx(double base); > >@@ -225,8 +225,8 @@ public: > > private: > >- int minBaseIdx; // min baseline bucket index >- int maxBaseIdx; // max baseline bucket index >+ SafeInt minBaseIdx; // min baseline bucket index >+ SafeInt maxBaseIdx; // max baseline bucket index > TextWord **pool; // array of linked lists, one for each > // baseline value (multiple of 4 pts) > TextWord *cursor; // pointer to last-accessed word >@@ -296,7 +296,7 @@ private: > double *edge; // "near" edge x or y coord of each char > // (plus one extra entry for the last char) > int *col; // starting column number of each Unicode char >- int len; // number of Unicode chars >+ SafeInt len; // number of Unicode chars > int convertedLen; // total number of converted characters > GBool hyphenated; // set if last char is a hyphen > TextLine *next; // next line in block >@@ -357,7 +357,7 @@ public: > void getBBox(double *xMinA, double *yMinA, double *xMaxA, double *yMaxA) > { *xMinA = xMin; *yMinA = yMin; *xMaxA = xMax; *yMaxA = yMax; } > >- int getLineCount() { return nLines; } >+ int getLineCount() { return nLines.Int(); } > > private: > >@@ -371,7 +371,7 @@ private: > // are built) > TextLine *lines; // linked list of lines > TextLine *curLine; // most recently added line >- int nLines; // number of lines >+ SafeInt nLines; // number of lines > int charCount; // number of characters in the block > int col; // starting column > int nColumns; // number of columns in the block >@@ -584,7 +584,7 @@ private: > TextPool *pools[4]; // a "pool" of TextWords for each rotation > TextFlow *flows; // linked list of flows > TextBlock **blocks; // array of blocks, in yx order >- int nBlocks; // number of blocks >+ SafeInt nBlocks; // number of blocks > int primaryRot; // primary rotation > GBool primaryLR; // primary direction (true means L-to-R, > // false means R-to-L) >Index: poppler-0.12.0/poppler/UnicodeMap.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/UnicodeMap.cc >+++ poppler-0.12.0/poppler/UnicodeMap.cc >@@ -39,7 +39,7 @@ UnicodeMap *UnicodeMap::parse(GooString > UnicodeMap *map; > UnicodeMapRange *range; > UnicodeMapExt *eMap; >- int size, eMapsSize; >+ SafeInt size, eMapsSize; > char buf[256]; > int line, nBytes, i, x; > char *tok1, *tok2, *tok3; >Index: poppler-0.12.0/utils/pdffonts.cc >=================================================================== >--- poppler-0.12.0.orig/utils/pdffonts.cc >+++ poppler-0.12.0/utils/pdffonts.cc >@@ -164,7 +164,7 @@ int main(int argc, char *argv[]) { > printf("name type emb sub uni object ID\n"); > printf("------------------------------------ ----------------- --- --- --- ---------\n"); > fonts = NULL; >- fontsLen = fontsSize = 0; >+ fontsSize = fontsLen = 0; > for (pg = firstPage; pg <= lastPage; ++pg) { > page = doc->getCatalog()->getPage(pg); > if ((resDict = page->getResourceDict())) { >Index: poppler-0.12.0/poppler/CairoFontEngine.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/CairoFontEngine.cc >+++ poppler-0.12.0/poppler/CairoFontEngine.cc >@@ -377,7 +377,7 @@ CairoFreeTypeFont *CairoFreeTypeFont::cr > cairo_font_face_t *font_face; > > Gushort *codeToGID; >- int codeToGIDLen; >+ SafeInt codeToGIDLen; > > dfp = NULL; > codeToGID = NULL; >@@ -533,7 +533,7 @@ CairoFreeTypeFont *CairoFreeTypeFont::cr > > return new CairoFreeTypeFont(ref, > font_face, face, >- codeToGID, codeToGIDLen, >+ codeToGID, codeToGIDLen.Int(), > substitute); > > err2: >Index: poppler-0.12.0/poppler/XRef.cc >=================================================================== >--- poppler-0.12.0.orig/poppler/XRef.cc >+++ poppler-0.12.0/poppler/XRef.cc >@@ -399,7 +399,8 @@ GBool XRef::readXRefTable(Parser *parser > GBool more; > Object obj, obj2; > Guint pos2; >- int first, n, newSize, i; >+ int first, n, i; >+ SafeInt newSize; > > while (1) { > parser->getObj(&obj); >@@ -421,7 +422,7 @@ GBool XRef::readXRefTable(Parser *parser > goto err1; > } > if (first + n > size) { >- for (newSize = size ? 2 * size : 1024; >+ for (newSize = size ? SafeInt(2) * SafeInt(size) : 1024; > first + n > newSize && newSize > 0; > newSize <<= 1) ; > if (newSize < 0) { >@@ -440,7 +441,7 @@ GBool XRef::readXRefTable(Parser *parser > entries[i].updated = false; > entries[i].gen = 0; > } >- size = newSize; >+ size = newSize.Int(); > } > for (i = first; i < first + n; ++i) { > if (!parser->getObj(&obj)->isInt()) { >@@ -628,13 +629,14 @@ GBool XRef::readXRefStream(Stream *xrefS > > GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) { > Guint offset; >- int type, gen, c, newSize, i, j; >+ int type, gen, c, i, j; >+ SafeInt newSize; > > if (first + n < 0) { > return gFalse; > } > if (first + n > size) { >- for (newSize = size ? 2 * size : 1024; >+ for (newSize = size ? SafeInt(2) * SafeInt(size) : 1024; > first + n > newSize && newSize > 0; > newSize <<= 1) ; > if (newSize < 0) { >@@ -652,7 +654,7 @@ GBool XRef::readXRefStreamSection(Stream > entries[i].updated = false; > entries[i].gen = 0; > } >- size = newSize; >+ size = newSize.Int(); > } > for (i = first; i < first + n; ++i) { > if (w[0] == 0) { >@@ -710,8 +712,8 @@ GBool XRef::constructXRef() { > char buf[256]; > Guint pos; > int num, gen; >- int newSize; >- int streamEndsSize; >+ SafeInt newSize; >+ SafeInt streamEndsSize; > char *p; > int i; > GBool gotRoot; >@@ -722,7 +724,7 @@ GBool XRef::constructXRef() { > > error(-1, "PDF file is damaged - attempting to reconstruct xref table..."); > gotRoot = gFalse; >- streamEndsLen = streamEndsSize = 0; >+ streamEndsSize = streamEndsLen = 0; > > str->reset(); > while (1) { >@@ -781,7 +783,7 @@ GBool XRef::constructXRef() { > } while (*p && isspace(*p)); > if (!strncmp(p, "obj", 3)) { > if (num >= size) { >- newSize = (num + 1 + 255) & ~255; >+ newSize = (SafeInt(num) + 1 + 255).Int() & ~255; > if (newSize < 0) { > error(-1, "Bad object number"); > return gFalse; >@@ -798,7 +800,7 @@ GBool XRef::constructXRef() { > entries[i].obj.initNull (); > entries[i].updated = false; > } >- size = newSize; >+ size = newSize.Int(); > } > if (entries[num].type == xrefEntryFree || > gen >= entries[num].gen) {
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 570183
:
336274
| 337644 |
337646