[poppler] TextWord::visitSelection brokeness

[Jeff Muizelaar]

TextWord::visitSelection appears to be broken. I can't really say how
because I didn't spend much time looking at it. However, the problem is
that 'begin' is not guaranteed to be less than 'end'. This causes
visitWord to blow up on string construction with a negative length.

http://www.cs.princeton.edu/~chazelle/pubs/sheap.pdf is a pdf that shows
the breakage.

void TextWord::visitSelection(TextSelectionVisitor *visitor,
                              PDFRectangle *selection) {
  int i, begin, end;

  begin = len + 1;
  end = 0;
  for (i = 0; i < len; i++) {
    if (selection->x1 < edge[i + 1] || selection->x2 < edge[i + 1])
      if (i < begin)
        begin = i;
    if (edge[i] < selection->x1 || edge[i] < selection->x2)
      end = i + 1;
  }

  visitor->visitWord (this, begin, end, selection);
}

-Jeff