[poppler] splash/SplashBitmap.cc splash/Splash.cc

[Albert Astals Cid]

 splash/Splash.cc       |   37 +++++++++++++++++++++++--------------
 splash/SplashBitmap.cc |   18 +++++++++++-------
 2 files changed, 34 insertions(+), 21 deletions(-)

New commits:
commit f48eb669ae5c729c026554802e666e64399c0900
Author: Albert Astals Cid <aacid at kde.org>
Date:   Sun Jun 24 23:43:03 2012 +0200

    Change SplashBitmap gmallocn to gmallocn_checkoverflow
    
    Fixes abort in KDE bug #302372

diff --git a/splash/Splash.cc b/splash/Splash.cc
index e5f7667..0e07c70 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -11,7 +11,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2005-2011 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2005-2012 Albert Astals Cid <aacid at kde.org>
 // Copyright (C) 2005 Marco Pesenti Gritti <mpg at redhat.com>
 // Copyright (C) 2010-2012 Thomas Freitag <Thomas.Freitag at alfa.de>
 // Copyright (C) 2010 Christian Feuersänger <cfeuersaenger at googlemail.com>
@@ -3625,6 +3625,10 @@ SplashError Splash::arbitraryTransformImage(SplashImageSource src, void *srcData
   }
   scaledImg = scaleImage(src, srcData, srcMode, nComps, srcAlpha,
 			 srcWidth, srcHeight, scaledWidth, scaledHeight);
+  
+  if (scaledImg == NULL) {
+    return splashErrBadArg;
+  }
 
   // construct the three sections
   i = 0;
@@ -3803,22 +3807,27 @@ SplashBitmap *Splash::scaleImage(SplashImageSource src, void *srcData,
   SplashBitmap *dest;
 
   dest = new SplashBitmap(scaledWidth, scaledHeight, 1, srcMode, srcAlpha);
-  if (scaledHeight < srcHeight) {
-    if (scaledWidth < srcWidth) {
-      scaleImageYdXd(src, srcData, srcMode, nComps, srcAlpha,
-		     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+  if (dest->getDataPtr() != NULL) {
+    if (scaledHeight < srcHeight) {
+      if (scaledWidth < srcWidth) {
+	scaleImageYdXd(src, srcData, srcMode, nComps, srcAlpha,
+		      srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      } else {
+	scaleImageYdXu(src, srcData, srcMode, nComps, srcAlpha,
+		      srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      }
     } else {
-      scaleImageYdXu(src, srcData, srcMode, nComps, srcAlpha,
-		     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      if (scaledWidth < srcWidth) {
+	scaleImageYuXd(src, srcData, srcMode, nComps, srcAlpha,
+		      srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      } else {
+	scaleImageYuXu(src, srcData, srcMode, nComps, srcAlpha,
+		      srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
+      }
     }
   } else {
-    if (scaledWidth < srcWidth) {
-      scaleImageYuXd(src, srcData, srcMode, nComps, srcAlpha,
-		     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
-    } else {
-      scaleImageYuXu(src, srcData, srcMode, nComps, srcAlpha,
-		     srcWidth, srcHeight, scaledWidth, scaledHeight, dest);
-    }
+    delete dest;
+    dest = NULL;
   }
   return dest;
 }
diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc
index e4f27fc..cd85543 100644
--- a/splash/SplashBitmap.cc
+++ b/splash/SplashBitmap.cc
@@ -101,13 +101,17 @@ SplashBitmap::SplashBitmap(int widthA, int heightA, int rowPadA,
     rowSize += rowPad - 1;
     rowSize -= rowSize % rowPad;
   }
-  data = (SplashColorPtr)gmallocn(rowSize, height);
-  if (!topDown) {
-    data += (height - 1) * rowSize;
-    rowSize = -rowSize;
-  }
-  if (alphaA) {
-    alpha = (Guchar *)gmallocn(width, height);
+  data = (SplashColorPtr)gmallocn_checkoverflow(rowSize, height);
+  if (data != NULL) {
+    if (!topDown) {
+      data += (height - 1) * rowSize;
+      rowSize = -rowSize;
+    }
+    if (alphaA) {
+      alpha = (Guchar *)gmallocn(width, height);
+    } else {
+      alpha = NULL;
+    }
   } else {
     alpha = NULL;
   }