[poppler] poppler/splash: SplashXPathScanner.cc, 1.1.1.1, 1.1.1.1.2.1

[Kristian Høgsberg]

Update of /cvs/poppler/poppler/splash
In directory kemper:/tmp/cvs-serv24691/splash

Modified Files:
      Tag: POPPLER_0_4_X
	SplashXPathScanner.cc 
Log Message:
2006-02-28  Kristian Høgsberg  <krh at redhat.com>

        * goo/gmem.c: (gmalloc), (grealloc):
        * poppler/JBIG2Stream.cc:
        * poppler/Stream.cc:
        * poppler/Stream.h:
        * splash/SplashXPathScanner.cc:

        More integer overflow fixes from Derek Noonburg (#5922).



Index: SplashXPathScanner.cc
===================================================================
RCS file: /cvs/poppler/poppler/splash/SplashXPathScanner.cc,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.2.1
diff -u -d -r1.1.1.1 -r1.1.1.1.2.1
--- SplashXPathScanner.cc	3 Mar 2005 19:46:00 -0000	1.1.1.1
+++ SplashXPathScanner.cc	28 Feb 2006 22:14:56 -0000	1.1.1.1.2.1
@@ -182,7 +182,7 @@
 }
 
 void SplashXPathScanner::computeIntersections(int y) {
-  SplashCoord ySegMin, ySegMax, xx0, xx1;
+  SplashCoord xSegMin, xSegMax, ySegMin, ySegMax, xx0, xx1;
   SplashXPathSeg *seg;
   int i, j;
 
@@ -232,19 +232,27 @@
     } else if (seg->flags & splashXPathVert) {
       xx0 = xx1 = seg->x0;
     } else {
-      if (ySegMin <= y) {
-	// intersection with top edge
-	xx0 = seg->x0 + (y - seg->y0) * seg->dxdy;
+      if (seg->x0 < seg->x1) {
+	xSegMin = seg->x0;
+	xSegMax = seg->x1;
       } else {
-	// x coord of segment endpoint with min y coord
-	xx0 = (seg->flags & splashXPathFlip) ? seg->x1 : seg->x0;
+	xSegMin = seg->x1;
+	xSegMax = seg->x0;
       }
-      if (ySegMax >= y + 1) {
-	// intersection with bottom edge
-	xx1 = seg->x0 + (y + 1 - seg->y0) * seg->dxdy;
-      } else {
-	// x coord of segment endpoint with max y coord
-	xx1 = (seg->flags & splashXPathFlip) ? seg->x0 : seg->x1;
+      // intersection with top edge
+      xx0 = seg->x0 + ((SplashCoord)y - seg->y0) * seg->dxdy;
+      // intersection with bottom edge
+      xx1 = seg->x0 + ((SplashCoord)y + 1 - seg->y0) * seg->dxdy;
+      // the segment may not actually extend to the top and/or bottom edges
+      if (xx0 < xSegMin) {
+	xx0 = xSegMin;
+      } else if (xx0 > xSegMax) {
+	xx0 = xSegMax;
+      }
+      if (xx1 < xSegMin) {
+	xx1 = xSegMin;
+      } else if (xx1 > xSegMax) {
+	xx1 = xSegMax;
       }
     }
     if (xx0 < xx1) {