Attachment 66312 Details for Bug 141242

[patch] backport to xpdf 3.00

xpdf-3.00.CVE-2006-0301.diff (text/plain), 1.70 KB, created by Ludwig Nussel on 2006-02-03 09:56:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2006-02-03 09:56:50 UTC

Size: 1.70 KB

patch

obsolete

>Index: xpdf-3.00/splash/SplashXPathScanner.cc
>===================================================================
>--- xpdf-3.00.orig/splash/SplashXPathScanner.cc
>+++ xpdf-3.00/splash/SplashXPathScanner.cc
>@@ -182,7 +182,7 @@ GBool SplashXPathScanner::getNextSpan(in
> }
> 
> void SplashXPathScanner::computeIntersections(int y) {
>-  SplashCoord ySegMin, ySegMax, xx0, xx1;
>+  SplashCoord xSegMin, xSegMax, ySegMin, ySegMax, xx0, xx1;
>   SplashXPathSeg *seg;
>   int i, j;
> 
>@@ -232,19 +232,27 @@ void SplashXPathScanner::computeIntersec
>     } else if (seg->flags & splashXPathVert) {
>       xx0 = xx1 = seg->x0;
>     } else {
>-      if (ySegMin <= y) {
>-	// intersection with top edge
>-	xx0 = seg->x0 + (y - seg->y0) * seg->dxdy;
>+      if (seg->x0 < seg->x1) {
>+	xSegMin = seg->x0;
>+	xSegMax = seg->x1;
>       } else {
>-	// x coord of segment endpoint with min y coord
>-	xx0 = (seg->flags & splashXPathFlip) ? seg->x1 : seg->x0;
>+	xSegMin = seg->x1;
>+	xSegMax = seg->x0;
>       }
>-      if (ySegMax >= y + 1) {
>-	// intersection with bottom edge
>-	xx1 = seg->x0 + (y + 1 - seg->y0) * seg->dxdy;
>-      } else {
>-	// x coord of segment endpoint with max y coord
>-	xx1 = (seg->flags & splashXPathFlip) ? seg->x0 : seg->x1;
>+      // intersection with top edge
>+      xx0 = seg->x0 + ((SplashCoord)y - seg->y0) * seg->dxdy;
>+      // intersection with bottom edge
>+      xx1 = seg->x0 + ((SplashCoord)y + 1 - seg->y0) * seg->dxdy;
>+      // the segment may not actually extend to the top and/or bottom edges
>+      if (xx0 < xSegMin) {
>+	xx0 = xSegMin;
>+      } else if (xx0 > xSegMax) {
>+	xx0 = xSegMax;
>+      }
>+      if (xx1 < xSegMin) {
>+	xx1 = xSegMin;
>+      } else if (xx1 > xSegMax) {
>+	xx1 = xSegMax;
>       }
>     }
>     if (xx0 < xx1) {

Actions: View | Diff

Attachments on bug 141242: 61896 | 61991 | 65255 | 66287 | 66312