xpdf bad memory access

From: Anil Madhavapeddy <anil(at)recoil.org>
Date: Thu Sep 25 2003 - 12:30:10 EDT

this cures a crash with the malloc guard on; looks like it goes into a negative array index. could people try this out on their pdfs and make sure it doesnt do any harm?

Index: patch-lib_type1_type1_c

---

RCS file: patch-lib_type1_type1_c
diff -N patch-lib_type1_type1_c

--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ patch-lib_type1_type1_c	25 Sep 2003 16:27:39 -0000

@@ -0,0 +1,25 @@

+$OpenBSD$
+--- lib/type1/type1.c.orig	2003-03-02 23:17:22.000000000 +0000
++++ lib/type1/type1.c	2003-09-25 17:22:47.000000000 +0100
+@@ -1868,10 +1868,18 @@ static int EndChar()
+ static int RMoveTo(dx,dy)
+   DOUBLE dx,dy;
+ {
+-  long pindex = 0;
+-  
++  long pindex = 0, xpoint, ypoint;
++
++  if (numppoints > 1) {
++	xpoint = currx - ppoints[numppoints-2].x;
++	ypoint = curry - ppoints[numppoints-2].y;
++  } else {
++	xpoint = 0;
++	ypoint = 0;
++  }
++
+   /* compute hinting for previous segment! */
+-  FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx, dy);
++  FindStems( currx, curry, xpoint, ypoint, dx, dy);
+ 
+   /* Allocate a new path point and pre-setup data */
+   pindex = nextPPoint();

Received on Thu Sep 25 12:34:04 2003