Attachment 66287 Details for Bug 141242

[patch] the official patch

post-3.5.1-kdegraphics-CVE-2006-0301.diff (text/plain), 1.64 KB, created by Dirk Mueller on 2006-02-02 23:15:46 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dirk Mueller

Created: 2006-02-02 23:15:46 UTC

Size: 1.64 KB

patch

obsolete

>--- kpdf/xpdf/splash/SplashXPathScanner.cc	(Revision 505052)
>+++ kpdf/xpdf/splash/SplashXPathScanner.cc	(Arbeitskopie)
>@@ -186,7 +186,7 @@ GBool SplashXPathScanner::getNextSpan(in
> }
> 
> void SplashXPathScanner::computeIntersections(int y) {
>-  SplashCoord ySegMin, ySegMax, xx0, xx1;
>+  SplashCoord xSegMin, xSegMax, ySegMin, ySegMax, xx0, xx1;
>   SplashXPathSeg *seg;
>   int i, j;
> 
>@@ -236,19 +236,27 @@ void SplashXPathScanner::computeIntersec
>     } else if (seg->flags & splashXPathVert) {
>       xx0 = xx1 = seg->x0;
>     } else {
>-      if (ySegMin <= y) {
>-	// intersection with top edge
>-	xx0 = seg->x0 + ((SplashCoord)y - seg->y0) * seg->dxdy;
>+      if (seg->x0 < seg->x1) {
>+	xSegMin = seg->x0;
>+	xSegMax = seg->x1;
>       } else {
>-	// x coord of segment endpoint with min y coord
>-	xx0 = (seg->flags & splashXPathFlip) ? seg->x1 : seg->x0;
>+	xSegMin = seg->x1;
>+	xSegMax = seg->x0;
>       }
>-      if (ySegMax >= y + 1) {
>-	// intersection with bottom edge
>-	xx1 = seg->x0 + ((SplashCoord)y + 1 - seg->y0) * seg->dxdy;
>-      } else {
>-	// x coord of segment endpoint with max y coord
>-	xx1 = (seg->flags & splashXPathFlip) ? seg->x0 : seg->x1;
>+      // intersection with top edge
>+      xx0 = seg->x0 + ((SplashCoord)y - seg->y0) * seg->dxdy;
>+      // intersection with bottom edge
>+      xx1 = seg->x0 + ((SplashCoord)y + 1 - seg->y0) * seg->dxdy;
>+      // the segment may not actually extend to the top and/or bottom edges
>+      if (xx0 < xSegMin) {
>+	xx0 = xSegMin;
>+      } else if (xx0 > xSegMax) {
>+	xx0 = xSegMax;
>+      }
>+      if (xx1 < xSegMin) {
>+	xx1 = xSegMin;
>+      } else if (xx1 > xSegMax) {
>+	xx1 = xSegMax;
>       }
>     }
>     if (xx0 < xx1) {

Actions: View | Diff

Attachments on bug 141242: 61896 | 61991 | 65255 | 66287 | 66312