Attachment 61991 Details for Bug 141242

[patch] the patch

xpdf-heap-overflow.diff (text/plain), 2.01 KB, created by Dirk Mueller on 2006-01-04 22:45:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dirk Mueller

Created: 2006-01-04 22:45:26 UTC

Size: 2.01 KB

patch

obsolete

>Index: xpdf/splash/Splash.cc
>===================================================================
>--- xpdf/splash/Splash.cc	(revision 493629)
>+++ xpdf/splash/Splash.cc	(working copy)
>@@ -426,6 +426,8 @@ void Splash::strokeNarrow(SplashXPath *x
>   int nClipRes[3];
>   int i;
> 
>+  nClipRes[0] = nClipRes[1] = nClipRes[2] = 0;
>+
>   for (i = 0, seg = xPath->segs; i < xPath->length; ++i, ++seg) {
> 
>     x0 = splashFloor(seg->x0);
>@@ -842,18 +844,18 @@ SplashError Splash::fillWithPattern(Spla
>     // draw the spans
>     for (y = yMinI; y <= yMaxI; ++y) {
>       while (scanner->getNextSpan(y, &x0, &x1)) {
>+        // limit the x range
>+	if (x0 < state->clip->getXMin()) {
>+	  x0 = state->clip->getXMin();
>+	}
>+	if (x1 > state->clip->getXMax()) {
>+	  x1 = state->clip->getXMax();
>+	}
> 	if (clipRes == splashClipAllInside) {
> 	  drawSpan(x0, x1, y, pattern, alpha, gTrue);
> 	} else {
>-	  // limit the x range
>-	  if (x0 < state->clip->getXMin()) {
>-	    x0 = state->clip->getXMin();
>-	  }
>-	  if (x1 > state->clip->getXMax()) {
>-	    x1 = state->clip->getXMax();
>-	  }
> 	  clipRes2 = state->clip->testSpan(x0, x1, y);
>-	  drawSpan(x0, x1, y, pattern, alpha, clipRes2 == splashClipAllInside);
>+          drawSpan(x0, x1, y, pattern, alpha, clipRes2 == splashClipAllInside);
> 	}
>       }
>     }
>@@ -896,16 +898,16 @@ SplashError Splash::xorFill(SplashPath *
>     // draw the spans
>     for (y = yMinI; y <= yMaxI; ++y) {
>       while (scanner->getNextSpan(y, &x0, &x1)) {
>+	// limit the x range
>+	if (x0 < state->clip->getXMin()) {
>+	  x0 = state->clip->getXMin();
>+	}
>+	if (x1 > state->clip->getXMax()) {
>+	  x1 = state->clip->getXMax();
>+	}
> 	if (clipRes == splashClipAllInside) {
> 	  xorSpan(x0, x1, y, state->fillPattern, gTrue);
> 	} else {
>-	  // limit the x range
>-	  if (x0 < state->clip->getXMin()) {
>-	    x0 = state->clip->getXMin();
>-	  }
>-	  if (x1 > state->clip->getXMax()) {
>-	    x1 = state->clip->getXMax();
>-	  }
> 	  clipRes2 = state->clip->testSpan(x0, x1, y);
> 	  xorSpan(x0, x1, y, state->fillPattern,
> 		  clipRes2 == splashClipAllInside);

Actions: View | Diff

Attachments on bug 141242: 61896 | 61991 | 65255 | 66287 | 66312