1 --- pdftops/GfxState.cxx.pdftops 2002-12-17 11:41:20.000000000 +0000
2 +++ pdftops/GfxState.cxx 2002-12-17 14:13:52.000000000 +0000
9 #include <string.h> // for memcpy()
14 indexHigh = indexHighA;
15 + // Checked in GfxIndexedColorSpace::parse
16 lookup = (Guchar *)gmalloc((indexHigh + 1) * base->getNComps() *
21 indexHighA = obj1.getInt();
23 + n = baseA->getNComps();
24 + if ((unsigned int)(indexHighA + 1) >= INT_MAX / (n * sizeof (Guchar))) {
25 + error(-1, "Bad Indexed color space (too high)");
28 cs = new GfxIndexedColorSpace(baseA, indexHighA);
30 - n = baseA->getNComps();
31 if (obj1.isStream()) {
33 for (i = 0; i <= indexHighA; ++i) {
35 colorSpace2 = indexedCS->getBase();
36 indexHigh = indexedCS->getIndexHigh();
37 nComps2 = colorSpace2->getNComps();
38 + if ((unsigned int)(indexHigh + 1) >= INT_MAX / (nComps2 * sizeof(double)))
40 lookup = (double *)gmalloc((indexHigh + 1) * nComps2 * sizeof(double));
41 lookup2 = indexedCS->getLookup();
42 for (i = 0; i <= indexHigh; ++i) {
44 sepCS = (GfxSeparationColorSpace *)colorSpace;
45 colorSpace2 = sepCS->getAlt();
46 nComps2 = colorSpace2->getNComps();
47 + if ((unsigned int)(maxPixel + 1) >= INT_MAX / (nComps2 * sizeof(double)))
49 lookup = (double *)gmalloc((maxPixel + 1) * nComps2 * sizeof(double));
50 sepFunc = sepCS->getFunc();
51 for (i = 0; i <= maxPixel; ++i) {
56 + if ((unsigned int)(maxPixel + 1) >= INT_MAX / (nComps * sizeof(double)))
58 lookup = (double *)gmalloc((maxPixel + 1) * nComps * sizeof(double));
59 for (i = 0; i <= maxPixel; ++i) {
60 for (k = 0; k < nComps; ++k) {
63 GfxSubpath::GfxSubpath(double x1, double y1) {
66 x = (double *)gmalloc(size * sizeof(double));
67 y = (double *)gmalloc(size * sizeof(double));
68 curve = (GBool *)gmalloc(size * sizeof(GBool));
70 GfxSubpath::GfxSubpath(GfxSubpath *subpath) {
73 + // safe (subpath->size is constrained)
74 x = (double *)gmalloc(size * sizeof(double));
75 y = (double *)gmalloc(size * sizeof(double));
76 curve = (GBool *)gmalloc(size * sizeof(GBool));
79 void GfxSubpath::lineTo(double x1, double y1) {
81 + if ((unsigned int)(size + 16) >= INT_MAX / sizeof (double)) return;
83 x = (double *)grealloc(x, size * sizeof(double));
84 y = (double *)grealloc(y, size * sizeof(double));
86 void GfxSubpath::curveTo(double x1, double y1, double x2, double y2,
87 double x3, double y3) {
89 + if ((unsigned int)(size + 16) >= INT_MAX / sizeof (double)) return;
91 x = (double *)grealloc(x, size * sizeof(double));
92 y = (double *)grealloc(y, size * sizeof(double));
98 subpaths = (GfxSubpath **)gmalloc(size * sizeof(GfxSubpath *));
101 @@ -1875,6 +1892,7 @@
106 subpaths = (GfxSubpath **)gmalloc(size * sizeof(GfxSubpath *));
107 for (i = 0; i < n; ++i)
108 subpaths[i] = subpaths1[i]->copy();
109 @@ -2063,8 +2081,10 @@
110 strokePattern = state->strokePattern->copy();
112 if (lineDashLength > 0) {
113 - lineDash = (double *)gmalloc(lineDashLength * sizeof(double));
114 - memcpy(lineDash, state->lineDash, lineDashLength * sizeof(double));
115 + if (lineDashLength < INT_MAX / sizeof (double)) {
116 + lineDash = (double *)gmalloc(lineDashLength * sizeof(double));
117 + memcpy(lineDash, state->lineDash, lineDashLength * sizeof(double));