[poppler] Branch 'poppler-0.22' - splash/Splash.cc

[Albert Astals Cid]

 splash/Splash.cc |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

New commits:
commit bbc2d8918fe234b7ef2c480eb148943922cc0959
Author: Albert Astals Cid <aacid at kde.org>
Date:   Thu Jan 10 19:07:48 2013 +0100

    Fix invalid memory accesses in 1036.pdf.asan.23.17

diff --git a/splash/Splash.cc b/splash/Splash.cc
index 24d934a..1f838af 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -14,7 +14,7 @@
 // Copyright (C) 2005-2013 Albert Astals Cid <aacid at kde.org>
 // Copyright (C) 2005 Marco Pesenti Gritti <mpg at redhat.com>
 // Copyright (C) 2010-2012 Thomas Freitag <Thomas.Freitag at alfa.de>
-// Copyright (C) 2010 Christian Feuersänger <cfeuersaenger at googlemail.com>
+// Copyright (C) 2010 Christian Feuersänger <cfeuersaenger at googlemail.com>
 // Copyright (C) 2011, 2012 William Bader <williambader at hotmail.com>
 // Copyright (C) 2012 Markus Trippelsdorf <markus at trippelsdorf.de>
 // Copyright (C) 2012 Adrian Johnson <ajohnson at redneon.com>
@@ -3308,6 +3308,12 @@ void Splash::scaleMaskYuXd(SplashImageMaskSource src, void *srcData,
   Guchar *destPtr0, *destPtr;
   int yp, yq, xp, xq, yt, y, yStep, xt, x, xStep, xx, d, d0, d1;
   int i;
+  
+  destPtr0 = dest->data;
+  if (destPtr0 == NULL) {
+    error(errInternal, -1, "dest->data is NULL in Splash::scaleMaskYuXd");
+    return;
+  }
 
   // Bresenham parameters for y scale
   yp = scaledHeight / srcHeight;
@@ -3323,7 +3329,6 @@ void Splash::scaleMaskYuXd(SplashImageMaskSource src, void *srcData,
   // init y scale Bresenham
   yt = 0;
 
-  destPtr0 = dest->data;
   for (y = 0; y < srcHeight; ++y) {
 
     // y scale Bresenham
@@ -4862,6 +4867,11 @@ void Splash::vertFlipImage(SplashBitmap *img, int width, int height,
   Guchar *lineBuf;
   Guchar *p0, *p1;
   int w;
+  
+  if (unlikely(img->data == NULL)) {
+    error(errInternal, -1, "img->data is NULL in Splash::vertFlipImage");
+    return;
+  }
 
   w = width * nComps;
   lineBuf = (Guchar *)gmalloc(w);