[poppler] 2 commits - poppler/Stream.cc splash/SplashBitmap.cc

[Albert Astals Cid]

 poppler/Stream.cc      |   10 ++++++----
 splash/SplashBitmap.cc |    3 ++-
 2 files changed, 8 insertions(+), 5 deletions(-)

New commits:
commit 9e36206465289c96cb189c648a6f5121714c647b
Author: Albert Astals Cid <aacid at kde.org>
Date:   Sun Apr 29 22:18:12 2012 +0200

    include for memcpy

diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc
index 6d37434..f252318 100644
--- a/splash/SplashBitmap.cc
+++ b/splash/SplashBitmap.cc
@@ -11,7 +11,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2006, 2009, 2010 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2006, 2009, 2010, 2012 Albert Astals Cid <aacid at kde.org>
 // Copyright (C) 2007 Ilmari Heikkinen <ilmari.heikkinen at gmail.com>
 // Copyright (C) 2009 Shen Liang <shenzhuxi at gmail.com>
 // Copyright (C) 2009 Stefan Thomas <thomas at eload24.com>
@@ -33,6 +33,7 @@
 #endif
 
 #include <stdio.h>
+#include <string.h>
 #include <stdlib.h>
 #include <limits.h>
 #include "goo/gmem.h"
commit 931051fe0bb445545355027d999515bc3d4b32ef
Author: Albert Astals Cid <aacid at kde.org>
Date:   Sun Apr 29 22:07:34 2012 +0200

    Make sure the index for refLine is in bounds
    
    Found in a fuzzed pdf sent by Mateusz "j00ru" Jurczyk and Gynvael Coldwind

diff --git a/poppler/Stream.cc b/poppler/Stream.cc
index 8bb12bd..423bf1c 100644
--- a/poppler/Stream.cc
+++ b/poppler/Stream.cc
@@ -14,7 +14,7 @@
 // under GPL version 2 or later
 //
 // Copyright (C) 2005 Jeff Muizelaar <jeff at infidigm.net>
-// Copyright (C) 2006-2010 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2006-2010, 2012 Albert Astals Cid <aacid at kde.org>
 // Copyright (C) 2007 Krzysztof Kowalczyk <kkowalczyk at gmail.com>
 // Copyright (C) 2008 Julien Rebetez <julien at fhtagn.net>
 // Copyright (C) 2009 Carlos Garcia Campos <carlosgc at gnome.org>
@@ -1727,9 +1727,11 @@ int CCITTFaxStream::lookChar() {
 	code1 = getTwoDimCode();
 	switch (code1) {
 	case twoDimPass:
-	  addPixels(refLine[b1i + 1], blackPixels);
-	  if (refLine[b1i + 1] < columns) {
-	    b1i += 2;
+	  if (likely(b1i + 1 < columns + 2)) {
+	    addPixels(refLine[b1i + 1], blackPixels);
+	    if (refLine[b1i + 1] < columns) {
+	      b1i += 2;
+	    }
 	  }
 	  break;
 	case twoDimHoriz: