Google Git
Sign in
android-kvm / buildroot / refs/tags/2009.08_rc1 / . / package / xpdf / xpdf-3.02pl2.patch
blob: ab9e3c671c7a32924e91f59297a566eac81ce060 [file] [log] [blame]
diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.cc xpdf-3.02/xpdf/Stream.cc
*** xpdf-3.02pl1.orig/xpdf/Stream.cc Thu Oct 25 15:47:38 2007
--- xpdf-3.02/xpdf/Stream.cc Thu Oct 25 15:48:19 2007
***************
*** 1243,1265 ****
columns = columnsA;
if (columns < 1) {
columns = 1;
! }
! if (columns + 4 <= 0) {
! columns = INT_MAX - 4;
}
rows = rowsA;
endOfBlock = endOfBlockA;
black = blackA;
! refLine = (short *)gmallocn(columns + 3, sizeof(short));
! codingLine = (short *)gmallocn(columns + 2, sizeof(short));
eof = gFalse;
row = 0;
nextLine2D = encoding < 0;
inputBits = 0;
! codingLine[0] = 0;
! codingLine[1] = refLine[2] = columns;
! a0 = 1;
buf = EOF;
}
--- 1243,1268 ----
columns = columnsA;
if (columns < 1) {
columns = 1;
! } else if (columns > INT_MAX - 2) {
! columns = INT_MAX - 2;
}
rows = rowsA;
endOfBlock = endOfBlockA;
black = blackA;
! // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
! // ---> max codingLine size = columns + 1
! // refLine has one extra guard entry at the end
! // ---> max refLine size = columns + 2
! codingLine = (int *)gmallocn(columns + 1, sizeof(int));
! refLine = (int *)gmallocn(columns + 2, sizeof(int));
eof = gFalse;
row = 0;
nextLine2D = encoding < 0;
inputBits = 0;
! codingLine[0] = columns;
! a0i = 0;
! outputBits = 0;
buf = EOF;
}
***************
*** 1278,1286 ****
row = 0;
nextLine2D = encoding < 0;
inputBits = 0;
! codingLine[0] = 0;
! codingLine[1] = columns;
! a0 = 1;
buf = EOF;
// skip any initial zero bits and end-of-line marker, and get the 2D
--- 1281,1289 ----
row = 0;
nextLine2D = encoding < 0;
inputBits = 0;
! codingLine[0] = columns;
! a0i = 0;
! outputBits = 0;
buf = EOF;
// skip any initial zero bits and end-of-line marker, and get the 2D
***************
*** 1297,1507 ****
}
}
int CCITTFaxStream::lookChar() {
short code1, code2, code3;
! int a0New;
! GBool err, gotEOL;
! int ret;
! int bits, i;
! // if at eof just return EOF
! if (eof && codingLine[a0] >= columns) {
! return EOF;
}
// read the next row
! err = gFalse;
! if (codingLine[a0] >= columns) {
// 2-D encoding
if (nextLine2D) {
- // state:
- // a0New = current position in coding line (0 <= a0New <= columns)
- // codingLine[a0] = last change in coding line
- // (black-to-white if a0 is even,
- // white-to-black if a0 is odd)
- // refLine[b1] = next change in reference line of opposite color
- // to a0
- // invariants:
- // 0 <= codingLine[a0] <= a0New
- // <= refLine[b1] <= refLine[b1+1] <= columns
- // 0 <= a0 <= columns+1
- // refLine[0] = 0
- // refLine[n] = refLine[n+1] = columns
- // -- for some 1 <= n <= columns+1
- // end condition:
- // 0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
- // < codingLine[n-1] < codingLine[n] = columns
- // -- where 1 <= n <= columns+1
for (i = 0; codingLine[i] < columns; ++i) {
refLine[i] = codingLine[i];
}
! refLine[i] = refLine[i + 1] = columns;
! b1 = 1;
! a0New = codingLine[a0 = 0] = 0;
! do {
code1 = getTwoDimCode();
switch (code1) {
case twoDimPass:
! if (refLine[b1] < columns) {
! a0New = refLine[b1 + 1];
! b1 += 2;
}
break;
case twoDimHoriz:
! if ((a0 & 1) == 0) {
! code1 = code2 = 0;
do {
! code1 += code3 = getWhiteCode();
} while (code3 >= 64);
do {
! code2 += code3 = getBlackCode();
} while (code3 >= 64);
} else {
- code1 = code2 = 0;
do {
! code1 += code3 = getBlackCode();
} while (code3 >= 64);
do {
! code2 += code3 = getWhiteCode();
} while (code3 >= 64);
}
! if (code1 > 0 || code2 > 0) {
! if (a0New + code1 <= columns) {
! codingLine[a0 + 1] = a0New + code1;
! } else {
! codingLine[a0 + 1] = columns;
! }
! ++a0;
! if (codingLine[a0] + code2 <= columns) {
! codingLine[a0 + 1] = codingLine[a0] + code2;
! } else {
! codingLine[a0 + 1] = columns;
! }
! ++a0;
! a0New = codingLine[a0];
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
}
break;
! case twoDimVert0:
! if (refLine[b1] < columns) {
! a0New = codingLine[++a0] = refLine[b1];
! ++b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
- } else {
- a0New = codingLine[++a0] = columns;
}
break;
case twoDimVertR1:
! if (refLine[b1] + 1 < columns) {
! a0New = codingLine[++a0] = refLine[b1] + 1;
! ++b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
- } else {
- a0New = codingLine[++a0] = columns;
}
break;
! case twoDimVertL1:
! if (refLine[b1] - 1 > a0New || (a0 == 0 && refLine[b1] == 1)) {
! a0New = codingLine[++a0] = refLine[b1] - 1;
! --b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
}
break;
! case twoDimVertR2:
! if (refLine[b1] + 2 < columns) {
! a0New = codingLine[++a0] = refLine[b1] + 2;
! ++b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
- } else {
- a0New = codingLine[++a0] = columns;
}
break;
case twoDimVertL2:
! if (refLine[b1] - 2 > a0New || (a0 == 0 && refLine[b1] == 2)) {
! a0New = codingLine[++a0] = refLine[b1] - 2;
! --b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
! }
! break;
! case twoDimVertR3:
! if (refLine[b1] + 3 < columns) {
! a0New = codingLine[++a0] = refLine[b1] + 3;
! ++b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
- } else {
- a0New = codingLine[++a0] = columns;
}
break;
! case twoDimVertL3:
! if (refLine[b1] - 3 > a0New || (a0 == 0 && refLine[b1] == 3)) {
! a0New = codingLine[++a0] = refLine[b1] - 3;
! --b1;
! while (refLine[b1] <= a0New && refLine[b1] < columns) {
! b1 += 2;
}
}
break;
case EOF:
eof = gTrue;
! codingLine[a0 = 0] = columns;
! return EOF;
default:
error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
err = gTrue;
break;
}
! } while (codingLine[a0] < columns);
// 1-D encoding
} else {
! codingLine[a0 = 0] = 0;
! while (1) {
code1 = 0;
! do {
! code1 += code3 = getWhiteCode();
! } while (code3 >= 64);
! codingLine[a0+1] = codingLine[a0] + code1;
! ++a0;
! if (codingLine[a0] >= columns) {
! break;
! }
! code2 = 0;
! do {
! code2 += code3 = getBlackCode();
! } while (code3 >= 64);
! codingLine[a0+1] = codingLine[a0] + code2;
! ++a0;
! if (codingLine[a0] >= columns) {
! break;
}
}
}
- if (codingLine[a0] != columns) {
- error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
- // force the row to be the correct length
- while (codingLine[a0] > columns) {
- --a0;
- }
- codingLine[++a0] = columns;
- err = gTrue;
- }
-
// byte-align the row
if (byteAlign) {
inputBits &= ~7;
--- 1300,1529 ----
}
}
+ inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
+ if (a1 > codingLine[a0i]) {
+ if (a1 > columns) {
+ error(getPos(), "CCITTFax row is wrong length (%d)", a1);
+ err = gTrue;
+ a1 = columns;
+ }
+ if ((a0i & 1) ^ blackPixels) {
+ ++a0i;
+ }
+ codingLine[a0i] = a1;
+ }
+ }
+
+ inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
+ if (a1 > codingLine[a0i]) {
+ if (a1 > columns) {
+ error(getPos(), "CCITTFax row is wrong length (%d)", a1);
+ err = gTrue;
+ a1 = columns;
+ }
+ if ((a0i & 1) ^ blackPixels) {
+ ++a0i;
+ }
+ codingLine[a0i] = a1;
+ } else if (a1 < codingLine[a0i]) {
+ if (a1 < 0) {
+ error(getPos(), "Invalid CCITTFax code");
+ err = gTrue;
+ a1 = 0;
+ }
+ while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
+ --a0i;
+ }
+ codingLine[a0i] = a1;
+ }
+ }
+
int CCITTFaxStream::lookChar() {
short code1, code2, code3;
! int b1i, blackPixels, i, bits;
! GBool gotEOL;
! if (buf != EOF) {
! return buf;
}
// read the next row
! if (outputBits == 0) {
!
! // if at eof just return EOF
! if (eof) {
! return EOF;
! }
!
! err = gFalse;
// 2-D encoding
if (nextLine2D) {
for (i = 0; codingLine[i] < columns; ++i) {
refLine[i] = codingLine[i];
}
! refLine[i++] = columns;
! refLine[i] = columns;
! codingLine[0] = 0;
! a0i = 0;
! b1i = 0;
! blackPixels = 0;
! // invariant:
! // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
! // <= columns
! // exception at left edge:
! // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
! // exception at right edge:
! // refLine[b1i] = refLine[b1i+1] = columns is possible
! while (codingLine[a0i] < columns) {
code1 = getTwoDimCode();
switch (code1) {
case twoDimPass:
! addPixels(refLine[b1i + 1], blackPixels);
! if (refLine[b1i + 1] < columns) {
! b1i += 2;
}
break;
case twoDimHoriz:
! code1 = code2 = 0;
! if (blackPixels) {
do {
! code1 += code3 = getBlackCode();
} while (code3 >= 64);
do {
! code2 += code3 = getWhiteCode();
} while (code3 >= 64);
} else {
do {
! code1 += code3 = getWhiteCode();
} while (code3 >= 64);
do {
! code2 += code3 = getBlackCode();
} while (code3 >= 64);
}
! addPixels(codingLine[a0i] + code1, blackPixels);
! if (codingLine[a0i] < columns) {
! addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
! }
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
! }
! break;
! case twoDimVertR3:
! addPixels(refLine[b1i] + 3, blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! ++b1i;
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
! case twoDimVertR2:
! addPixels(refLine[b1i] + 2, blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! ++b1i;
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
case twoDimVertR1:
! addPixels(refLine[b1i] + 1, blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! ++b1i;
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
! case twoDimVert0:
! addPixels(refLine[b1i], blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! ++b1i;
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
! case twoDimVertL3:
! addPixelsNeg(refLine[b1i] - 3, blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! if (b1i > 0) {
! --b1i;
! } else {
! ++b1i;
! }
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
case twoDimVertL2:
! addPixelsNeg(refLine[b1i] - 2, blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! if (b1i > 0) {
! --b1i;
! } else {
! ++b1i;
}
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
! case twoDimVertL1:
! addPixelsNeg(refLine[b1i] - 1, blackPixels);
! blackPixels ^= 1;
! if (codingLine[a0i] < columns) {
! if (b1i > 0) {
! --b1i;
! } else {
! ++b1i;
! }
! while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
! b1i += 2;
}
}
break;
case EOF:
+ addPixels(columns, 0);
eof = gTrue;
! break;
default:
error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
+ addPixels(columns, 0);
err = gTrue;
break;
}
! }
// 1-D encoding
} else {
! codingLine[0] = 0;
! a0i = 0;
! blackPixels = 0;
! while (codingLine[a0i] < columns) {
code1 = 0;
! if (blackPixels) {
! do {
! code1 += code3 = getBlackCode();
! } while (code3 >= 64);
! } else {
! do {
! code1 += code3 = getWhiteCode();
! } while (code3 >= 64);
}
+ addPixels(codingLine[a0i] + code1, blackPixels);
+ blackPixels ^= 1;
}
}
// byte-align the row
if (byteAlign) {
inputBits &= ~7;
***************
*** 1560,1573 ****
// this if we know the stream contains end-of-line markers because
// the "just plow on" technique tends to work better otherwise
} else if (err && endOfLine) {
! do {
if (code1 == EOF) {
eof = gTrue;
return EOF;
}
eatBits(1);
! code1 = lookBits(13);
! } while ((code1 >> 1) != 0x001);
eatBits(12);
if (encoding > 0) {
eatBits(1);
--- 1582,1598 ----
// this if we know the stream contains end-of-line markers because
// the "just plow on" technique tends to work better otherwise
} else if (err && endOfLine) {
! while (1) {
! code1 = lookBits(13);
if (code1 == EOF) {
eof = gTrue;
return EOF;
}
+ if ((code1 >> 1) == 0x001) {
+ break;
+ }
eatBits(1);
! }
eatBits(12);
if (encoding > 0) {
eatBits(1);
***************
*** 1575,1585 ****
}
}
! a0 = 0;
! outputBits = codingLine[1] - codingLine[0];
! if (outputBits == 0) {
! a0 = 1;
! outputBits = codingLine[2] - codingLine[1];
}
++row;
--- 1600,1610 ----
}
}
! // set up for output
! if (codingLine[0] > 0) {
! outputBits = codingLine[a0i = 0];
! } else {
! outputBits = codingLine[a0i = 1];
}
++row;
***************
*** 1587,1625 ****
// get a byte
if (outputBits >= 8) {
! ret = ((a0 & 1) == 0) ? 0xff : 0x00;
! if ((outputBits -= 8) == 0) {
! ++a0;
! if (codingLine[a0] < columns) {
! outputBits = codingLine[a0 + 1] - codingLine[a0];
! }
}
} else {
bits = 8;
! ret = 0;
do {
if (outputBits > bits) {
! i = bits;
! bits = 0;
! if ((a0 & 1) == 0) {
! ret |= 0xff >> (8 - i);
}
! outputBits -= i;
} else {
! i = outputBits;
! bits -= outputBits;
! if ((a0 & 1) == 0) {
! ret |= (0xff >> (8 - i)) << bits;
}
outputBits = 0;
! ++a0;
! if (codingLine[a0] < columns) {
! outputBits = codingLine[a0 + 1] - codingLine[a0];
}
}
! } while (bits > 0 && codingLine[a0] < columns);
}
- buf = black ? (ret ^ 0xff) : ret;
return buf;
}
--- 1612,1654 ----
// get a byte
if (outputBits >= 8) {
! buf = (a0i & 1) ? 0x00 : 0xff;
! outputBits -= 8;
! if (outputBits == 0 && codingLine[a0i] < columns) {
! ++a0i;
! outputBits = codingLine[a0i] - codingLine[a0i - 1];
}
} else {
bits = 8;
! buf = 0;
do {
if (outputBits > bits) {
! buf <<= bits;
! if (!(a0i & 1)) {
! buf |= 0xff >> (8 - bits);
}
! outputBits -= bits;
! bits = 0;
} else {
! buf <<= outputBits;
! if (!(a0i & 1)) {
! buf |= 0xff >> (8 - outputBits);
}
+ bits -= outputBits;
outputBits = 0;
! if (codingLine[a0i] < columns) {
! ++a0i;
! outputBits = codingLine[a0i] - codingLine[a0i - 1];
! } else if (bits > 0) {
! buf <<= bits;
! bits = 0;
}
}
! } while (bits);
! }
! if (black) {
! buf ^= 0xff;
}
return buf;
}
***************
*** 1661,1666 ****
--- 1690,1698 ----
code = 0; // make gcc happy
if (endOfBlock) {
code = lookBits(12);
+ if (code == EOF) {
+ return 1;
+ }
if ((code >> 5) == 0) {
p = &whiteTab1[code];
} else {
***************
*** 1673,1678 ****
--- 1705,1713 ----
} else {
for (n = 1; n <= 9; ++n) {
code = lookBits(n);
+ if (code == EOF) {
+ return 1;
+ }
if (n < 9) {
code <<= 9 - n;
}
***************
*** 1684,1689 ****
--- 1719,1727 ----
}
for (n = 11; n <= 12; ++n) {
code = lookBits(n);
+ if (code == EOF) {
+ return 1;
+ }
if (n < 12) {
code <<= 12 - n;
}
***************
*** 1709,1717 ****
code = 0; // make gcc happy
if (endOfBlock) {
code = lookBits(13);
if ((code >> 7) == 0) {
p = &blackTab1[code];
! } else if ((code >> 9) == 0) {
p = &blackTab2[(code >> 1) - 64];
} else {
p = &blackTab3[code >> 7];
--- 1747,1758 ----
code = 0; // make gcc happy
if (endOfBlock) {
code = lookBits(13);
+ if (code == EOF) {
+ return 1;
+ }
if ((code >> 7) == 0) {
p = &blackTab1[code];
! } else if ((code >> 9) == 0 && (code >> 7) != 0) {
p = &blackTab2[(code >> 1) - 64];
} else {
p = &blackTab3[code >> 7];
***************
*** 1723,1728 ****
--- 1764,1772 ----
} else {
for (n = 2; n <= 6; ++n) {
code = lookBits(n);
+ if (code == EOF) {
+ return 1;
+ }
if (n < 6) {
code <<= 6 - n;
}
***************
*** 1734,1739 ****
--- 1778,1786 ----
}
for (n = 7; n <= 12; ++n) {
code = lookBits(n);
+ if (code == EOF) {
+ return 1;
+ }
if (n < 12) {
code <<= 12 - n;
}
***************
*** 1747,1752 ****
--- 1794,1802 ----
}
for (n = 10; n <= 13; ++n) {
code = lookBits(n);
+ if (code == EOF) {
+ return 1;
+ }
if (n < 13) {
code <<= 13 - n;
}
***************
*** 1961,1966 ****
--- 2011,2022 ----
// allocate a buffer for the whole image
bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
+ if (bufWidth <= 0 || bufHeight <= 0 ||
+ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
+ error(getPos(), "Invalid image size in DCT stream");
+ y = height;
+ return;
+ }
for (i = 0; i < numComps; ++i) {
frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
***************
*** 3036,3041 ****
--- 3092,3102 ----
}
scanInfo.firstCoeff = str->getChar();
scanInfo.lastCoeff = str->getChar();
+ if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
+ scanInfo.firstCoeff > scanInfo.lastCoeff) {
+ error(getPos(), "Bad DCT coefficient numbers in scan info block");
+ return gFalse;
+ }
c = str->getChar();
scanInfo.ah = (c >> 4) & 0x0f;
scanInfo.al = c & 0x0f;
diff -c -r xpdf-3.02pl1.orig/xpdf/Stream.h xpdf-3.02/xpdf/Stream.h
*** xpdf-3.02pl1.orig/xpdf/Stream.h Tue Feb 27 14:05:52 2007
--- xpdf-3.02/xpdf/Stream.h Thu Oct 25 15:48:15 2007
***************
*** 528,540 ****
int row; // current row
int inputBuf; // input buffer
int inputBits; // number of bits in input buffer
! short *refLine; // reference line changing elements
! int b1; // index into refLine
! short *codingLine; // coding line changing elements
! int a0; // index into codingLine
int outputBits; // remaining ouput bits
int buf; // character buffer
short getTwoDimCode();
short getWhiteCode();
short getBlackCode();
--- 528,542 ----
int row; // current row
int inputBuf; // input buffer
int inputBits; // number of bits in input buffer
! int *codingLine; // coding line changing elements
! int *refLine; // reference line changing elements
! int a0i; // index into codingLine
! GBool err; // error on current line
int outputBits; // remaining ouput bits
int buf; // character buffer
+ void addPixels(int a1, int black);
+ void addPixelsNeg(int a1, int black);
short getTwoDimCode();
short getWhiteCode();
short getBlackCode();