[poppler] poppler/splash: Splash.cc,1.2,1.2.2.1

[Kristian Høgsberg]

Update of /cvs/poppler/poppler/splash
In directory gabe:/tmp/cvs-serv20797/splash

Modified Files:
      Tag: POPPLER_0_4_X
	Splash.cc 
Log Message:
2006-02-09  Kristian Høgsberg  <krh at redhat.com>

        * configure.ac: Bump realease to 0.4.5.

        * NEWS: Sum up changes.

        * splash/Splash.cc: Add fix for CVE-2006-0301.



Index: Splash.cc
===================================================================
RCS file: /cvs/poppler/poppler/splash/Splash.cc,v
retrieving revision 1.2
retrieving revision 1.2.2.1
diff -u -d -r1.2 -r1.2.2.1
--- Splash.cc	22 Jul 2005 10:33:54 -0000	1.2
+++ Splash.cc	9 Feb 2006 19:17:03 -0000	1.2.2.1
@@ -728,6 +728,10 @@
   SplashRGB8P *rgb8p;
   SplashBGR8P *bgr8;
 
+  if ( (unsigned) x >= (unsigned) bitmap->getWidth() ||
+       (unsigned) y >= (unsigned) bitmap->getHeight())
+      return;
+
   if (noClip || state->clip->test(x, y)) {
     switch (bitmap->mode) {
     case splashModeMono1:
@@ -766,6 +770,10 @@
   SplashRGB8P *rgb8p;
   SplashBGR8P *bgr8;
 
+  if ( (unsigned) x >= (unsigned) bitmap->getWidth() ||
+       (unsigned) y >= (unsigned) bitmap->getHeight())
+    return;
+
   if (noClip || state->clip->test(x, y)) {
     color = pattern->getColor(x, y);
     switch (bitmap->mode) {
@@ -810,6 +818,11 @@
   SplashMono1 mask1;
   int i, j, n;
 
+  if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) y >= (unsigned) bitmap->getHeight())
+      return;
+
   n = x1 - x0 + 1;
 
   switch (bitmap->mode) {
@@ -909,6 +922,11 @@
   SplashMono1 mask1;
   int i, j, n;
 
+  if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+      (unsigned) y >= (unsigned) bitmap->getHeight())
+    return;
+
   n = x1 - x0 + 1;
 
   switch (bitmap->mode) {