[poppler] Fix rare segmentation fault in CID font vertical exceptions assignment

[Peter A. Kerzum]

Ok, I'll prepare the collection in a while.
These are public documents downloaded from internet.

We have also seen interesting cases of correct, but quite different results for 
i386 and x86_64 platforms in terms of text output sequence.

On Wednesday 29 June 2011 12:18:41 Albert Astals Cid wrote:
> A Wednesday, June 29, 2011, Peter A. Kerzum va escriure:
> > Albert,
> > 
> > please excuse me for late reply
> > actually I have quite a collection of PDFs that crash poppler in
> > different ways, even with rendering disabled
> > 
> > If you are still interested, I can share
> 
> Of course I am.
> 
> If possible it would be good if you could create bugs in
> bugs.freedesktop.org and attach them there. If the pdf files are private
> just send them to my mail address.
> 
> Albert
> 
> > - Peter
> > 
> > В сообщении от Четверг 16 апреля 2009 02:03:04 автор Albert Astals Cid
> > 
> > написал:
> > > A Dimecres, 15 d'abril de 2009, Peter Kerzum va escriure:
> > > > Good morning!
> > > > 
> > > > While using xpdf we encountered an error that applies both to xpdf
> > > > and poppler. It seems to be a result of unattended copy-paste -
> > > > index of horizontal exception is applied to vertical
> > > > 
> > > > Please consider applying the following patch:
> > > > 
> > > > --- a/GfxFont.cc
> > > > +++ b/GfxFont.cc
> > > > @@ -1590,11 +1590,11 @@ GfxCIDFont::GfxCIDFont(XRef *xref, char
> > > > *tagA, Ref idA, GooString *nameA,
> > > > 
> > > >           if (obj3.arrayGet(k, &obj4)->isNum() &&
> > > >           
> > > >               obj3.arrayGet(k+1, &obj5)->isNum() &&
> > > >               obj3.arrayGet(k+2, &obj6)->isNum()) {
> > > > 
> > > > -           widths.excepsV[widths.nExceps].first = j;
> > > > -           widths.excepsV[widths.nExceps].last = j;
> > > > -           widths.excepsV[widths.nExceps].height = obj4.getNum() *
> > > > 0.001; -           widths.excepsV[widths.nExceps].vx = obj5.getNum()
> > > > * 0.001; -           widths.excepsV[widths.nExceps].vy =
> > > > obj6.getNum() * 0.001; +          
> > > > widths.excepsV[widths.nExcepsV].first = j; +          
> > > > widths.excepsV[widths.nExcepsV].last = j;
> > > > +           widths.excepsV[widths.nExcepsV].height = obj4.getNum() *
> > > > 0.001; +           widths.excepsV[widths.nExcepsV].vx = obj5.getNum()
> > > > * 0.001; +           widths.excepsV[widths.nExcepsV].vy =
> > > > obj6.getNum() * 0.001;
> > > > 
> > > >             ++j;
> > > >             ++widths.nExcepsV;
> > > >           
> > > >           } else {
> > > 
> > > Can we get a sample PDF that has this problem?
> > > 
> > > Albert

-- 
Пётр Керзум
Группа разработки поисковой платформы
СПб, тел. 8508