Slackware 13.1slackware-13.1

Wed May 19 08:58:23 UTC 2010
Slackware 13.1 x86_64 stable is released!
Lots of thanks are due -- see the RELEASE_NOTES and the rest of the
ChangeLog for credits.  The ISOs are on their way to replication,
a 6 CD-ROM 32-bit set and a dual-sided 32-bit/64-bit x86/x86_64 DVD.
We are taking pre-orders now at store.slackware.com, and offering
a discount if you sign up for a subscription.  Consider picking up
a copy to help support the project.  Thanks again to the Slackware
community for testing, contributing, and generally holding us to a
high level of quality.  :-)
Enjoy!

1 files changed, 1145 insertions, 0 deletions

diff --git a/source/xap/xpdf/patches/xpdf-3.02pl3.patch b/source/xap/xpdf/patches/xpdf-3.02pl3.patch
new file mode 100644
index 00000000..b5988805
--- /dev/null
+++ b/source/xap/xpdf/patches/xpdf-3.02pl3.patch
@@ -0,0 +1,1145 @@
+diff -r -c xpdf-3.02.orig/goo/gmem.cc xpdf-3.02/goo/gmem.cc
+*** xpdf-3.02.orig/goo/gmem.cc	Tue Feb 27 14:05:51 2007
+--- xpdf-3.02/goo/gmem.cc	Thu Mar 19 15:47:25 2009
+***************
+*** 55,61 ****
+    void *data;
+    unsigned long *trl, *p;
+  
+!   if (size <= 0) {
+      return NULL;
+    }
+    size1 = gMemDataSize(size);
+--- 55,69 ----
+    void *data;
+    unsigned long *trl, *p;
+  
+!   if (size < 0) {
+! #if USE_EXCEPTIONS
+!     throw GMemException();
+! #else
+!     fprintf(stderr, "Invalid memory allocation size\n");
+!     exit(1);
+! #endif
+!   }
+!   if (size == 0) {
+      return NULL;
+    }
+    size1 = gMemDataSize(size);
+***************
+*** 91,97 ****
+  #else
+    void *p;
+  
+!   if (size <= 0) {
+      return NULL;
+    }
+    if (!(p = malloc(size))) {
+--- 99,113 ----
+  #else
+    void *p;
+  
+!   if (size < 0) {
+! #if USE_EXCEPTIONS
+!     throw GMemException();
+! #else
+!     fprintf(stderr, "Invalid memory allocation size\n");
+!     exit(1);
+! #endif
+!   }
+!   if (size == 0) {
+      return NULL;
+    }
+    if (!(p = malloc(size))) {
+***************
+*** 112,118 ****
+    void *q;
+    int oldSize;
+  
+!   if (size <= 0) {
+      if (p) {
+        gfree(p);
+      }
+--- 128,142 ----
+    void *q;
+    int oldSize;
+  
+!   if (size < 0) {
+! #if USE_EXCEPTIONS
+!     throw GMemException();
+! #else
+!     fprintf(stderr, "Invalid memory allocation size\n");
+!     exit(1);
+! #endif
+!   }
+!   if (size == 0) {
+      if (p) {
+        gfree(p);
+      }
+***************
+*** 131,137 ****
+  #else
+    void *q;
+  
+!   if (size <= 0) {
+      if (p) {
+        free(p);
+      }
+--- 155,169 ----
+  #else
+    void *q;
+  
+!   if (size < 0) {
+! #if USE_EXCEPTIONS
+!     throw GMemException();
+! #else
+!     fprintf(stderr, "Invalid memory allocation size\n");
+!     exit(1);
+! #endif
+!   }
+!   if (size == 0) {
+      if (p) {
+        free(p);
+      }
+diff -r -c xpdf-3.02.orig/xpdf/JBIG2Stream.cc xpdf-3.02/xpdf/JBIG2Stream.cc
+*** xpdf-3.02.orig/xpdf/JBIG2Stream.cc	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/JBIG2Stream.cc	Tue Mar 31 10:55:23 2009
+***************
+*** 422,433 ****
+    table[i] = table[len];
+  
+    // assign prefixes
+!   i = 0;
+!   prefix = 0;
+!   table[i++].prefix = prefix++;
+!   for (; table[i].rangeLen != jbig2HuffmanEOT; ++i) {
+!     prefix <<= table[i].prefixLen - table[i-1].prefixLen;
+!     table[i].prefix = prefix++;
+    }
+  }
+  
+--- 422,435 ----
+    table[i] = table[len];
+  
+    // assign prefixes
+!   if (table[0].rangeLen != jbig2HuffmanEOT) {
+!     i = 0;
+!     prefix = 0;
+!     table[i++].prefix = prefix++;
+!     for (; table[i].rangeLen != jbig2HuffmanEOT; ++i) {
+!       prefix <<= table[i].prefixLen - table[i-1].prefixLen;
+!       table[i].prefix = prefix++;
+!     }
+    }
+  }
+  
+***************
+*** 491,497 ****
+    }
+    if (p->bits < 0) {
+      error(str->getPos(), "Bad two dim code in JBIG2 MMR stream");
+!     return 0;
+    }
+    bufLen -= p->bits;
+    return p->n;
+--- 493,499 ----
+    }
+    if (p->bits < 0) {
+      error(str->getPos(), "Bad two dim code in JBIG2 MMR stream");
+!     return EOF;
+    }
+    bufLen -= p->bits;
+    return p->n;
+***************
+*** 507,513 ****
+      ++nBytesRead;
+    }
+    while (1) {
+!     if (bufLen >= 7 && ((buf >> (bufLen - 7)) & 0x7f) == 0) {
+        if (bufLen <= 12) {
+  	code = buf << (12 - bufLen);
+        } else {
+--- 509,515 ----
+      ++nBytesRead;
+    }
+    while (1) {
+!     if (bufLen >= 11 && ((buf >> (bufLen - 7)) & 0x7f) == 0) {
+        if (bufLen <= 12) {
+  	code = buf << (12 - bufLen);
+        } else {
+***************
+*** 550,563 ****
+      ++nBytesRead;
+    }
+    while (1) {
+!     if (bufLen >= 6 && ((buf >> (bufLen - 6)) & 0x3f) == 0) {
+        if (bufLen <= 13) {
+  	code = buf << (13 - bufLen);
+        } else {
+  	code = buf >> (bufLen - 13);
+        }
+        p = &blackTab1[code & 0x7f];
+!     } else if (bufLen >= 4 && ((buf >> (bufLen - 4)) & 0x0f) == 0) {
+        if (bufLen <= 12) {
+  	code = buf << (12 - bufLen);
+        } else {
+--- 552,566 ----
+      ++nBytesRead;
+    }
+    while (1) {
+!     if (bufLen >= 10 && ((buf >> (bufLen - 6)) & 0x3f) == 0) {
+        if (bufLen <= 13) {
+  	code = buf << (13 - bufLen);
+        } else {
+  	code = buf >> (bufLen - 13);
+        }
+        p = &blackTab1[code & 0x7f];
+!     } else if (bufLen >= 7 && ((buf >> (bufLen - 4)) & 0x0f) == 0 &&
+! 	       ((buf >> (bufLen - 6)) & 0x03) != 0) {
+        if (bufLen <= 12) {
+  	code = buf << (12 - bufLen);
+        } else {
+***************
+*** 683,690 ****
+    h = hA;
+    line = (wA + 7) >> 3;
+    if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
+!     data = NULL;
+!     return;
+    }
+    // need to allocate one extra guard byte for use in combine()
+    data = (Guchar *)gmalloc(h * line + 1);
+--- 686,694 ----
+    h = hA;
+    line = (wA + 7) >> 3;
+    if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
+!     // force a call to gmalloc(-1), which will throw an exception
+!     h = -1;
+!     line = 2;
+    }
+    // need to allocate one extra guard byte for use in combine()
+    data = (Guchar *)gmalloc(h * line + 1);
+***************
+*** 698,705 ****
+    h = bitmap->h;
+    line = bitmap->line;
+    if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
+!     data = NULL;
+!     return;
+    }
+    // need to allocate one extra guard byte for use in combine()
+    data = (Guchar *)gmalloc(h * line + 1);
+--- 702,710 ----
+    h = bitmap->h;
+    line = bitmap->line;
+    if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
+!     // force a call to gmalloc(-1), which will throw an exception
+!     h = -1;
+!     line = 2;
+    }
+    // need to allocate one extra guard byte for use in combine()
+    data = (Guchar *)gmalloc(h * line + 1);
+***************
+*** 754,759 ****
+--- 759,766 ----
+  inline void JBIG2Bitmap::getPixelPtr(int x, int y, JBIG2BitmapPtr *ptr) {
+    if (y < 0 || y >= h || x >= w) {
+      ptr->p = NULL;
++     ptr->shift = 0; // make gcc happy
++     ptr->x = 0; // make gcc happy
+    } else if (x < 0) {
+      ptr->p = &data[y * line];
+      ptr->shift = 7;
+***************
+*** 798,803 ****
+--- 805,814 ----
+    Guint src0, src1, src, dest, s1, s2, m1, m2, m3;
+    GBool oneByte;
+  
++   // check for the pathological case where y = -2^31
++   if (y < -0x7fffffff) {
++     return;
++   }
+    if (y < 0) {
+      y0 = -y;
+    } else {
+***************
+*** 1011,1018 ****
+--- 1022,1034 ----
+  JBIG2SymbolDict::JBIG2SymbolDict(Guint segNumA, Guint sizeA):
+    JBIG2Segment(segNumA)
+  {
++   Guint i;
++ 
+    size = sizeA;
+    bitmaps = (JBIG2Bitmap **)gmallocn(size, sizeof(JBIG2Bitmap *));
++   for (i = 0; i < size; ++i) {
++     bitmaps[i] = NULL;
++   }
+    genericRegionStats = NULL;
+    refinementRegionStats = NULL;
+  }
+***************
+*** 1021,1027 ****
+    Guint i;
+  
+    for (i = 0; i < size; ++i) {
+!     delete bitmaps[i];
+    }
+    gfree(bitmaps);
+    if (genericRegionStats) {
+--- 1037,1045 ----
+    Guint i;
+  
+    for (i = 0; i < size; ++i) {
+!     if (bitmaps[i]) {
+!       delete bitmaps[i];
+!     }
+    }
+    gfree(bitmaps);
+    if (genericRegionStats) {
+***************
+*** 1296,1301 ****
+--- 1314,1326 ----
+        goto eofError2;
+      }
+  
++     // check for missing page information segment
++     if (!pageBitmap && ((segType >= 4 && segType <= 7) ||
++ 			(segType >= 20 && segType <= 43))) {
++       error(getPos(), "First JBIG2 segment associated with a page must be a page information segment");
++       goto syntaxError;
++     }
++ 
+      // read the segment data
+      switch (segType) {
+      case 0:
+***************
+*** 1411,1416 ****
+--- 1436,1443 ----
+    Guint i, j, k;
+    Guchar *p;
+  
++   symWidths = NULL;
++ 
+    // symbol dictionary flags
+    if (!readUWord(&flags)) {
+      goto eofError;
+***************
+*** 1466,1485 ****
+    codeTables = new GList();
+    numInputSyms = 0;
+    for (i = 0; i < nRefSegs; ++i) {
+!     seg = findSegment(refSegs[i]);
+!     if (seg->getType() == jbig2SegSymbolDict) {
+!       numInputSyms += ((JBIG2SymbolDict *)seg)->getSize();
+!     } else if (seg->getType() == jbig2SegCodeTable) {
+!       codeTables->append(seg);
+      }
+    }
+  
+    // compute symbol code length
+!   symCodeLen = 0;
+!   i = 1;
+!   while (i < numInputSyms + numNewSyms) {
+      ++symCodeLen;
+!     i <<= 1;
+    }
+  
+    // get the input symbol bitmaps
+--- 1493,1524 ----
+    codeTables = new GList();
+    numInputSyms = 0;
+    for (i = 0; i < nRefSegs; ++i) {
+!     if ((seg = findSegment(refSegs[i]))) {
+!       if (seg->getType() == jbig2SegSymbolDict) {
+! 	j = ((JBIG2SymbolDict *)seg)->getSize();
+! 	if (numInputSyms > UINT_MAX - j) {
+! 	  error(getPos(), "Too many input symbols in JBIG2 symbol dictionary");
+! 	  delete codeTables;
+! 	  goto eofError;
+! 	}
+! 	numInputSyms += j;
+!       } else if (seg->getType() == jbig2SegCodeTable) {
+! 	codeTables->append(seg);
+!       }
+      }
+    }
++   if (numInputSyms > UINT_MAX - numNewSyms) {
++     error(getPos(), "Too many input symbols in JBIG2 symbol dictionary");
++     delete codeTables;
++     goto eofError;
++   }
+  
+    // compute symbol code length
+!   symCodeLen = 1;
+!   i = (numInputSyms + numNewSyms) >> 1;
+!   while (i) {
+      ++symCodeLen;
+!     i >>= 1;
+    }
+  
+    // get the input symbol bitmaps
+***************
+*** 1491,1501 ****
+    k = 0;
+    inputSymbolDict = NULL;
+    for (i = 0; i < nRefSegs; ++i) {
+!     seg = findSegment(refSegs[i]);
+!     if (seg->getType() == jbig2SegSymbolDict) {
+!       inputSymbolDict = (JBIG2SymbolDict *)seg;
+!       for (j = 0; j < inputSymbolDict->getSize(); ++j) {
+! 	bitmaps[k++] = inputSymbolDict->getBitmap(j);
+        }
+      }
+    }
+--- 1530,1541 ----
+    k = 0;
+    inputSymbolDict = NULL;
+    for (i = 0; i < nRefSegs; ++i) {
+!     if ((seg = findSegment(refSegs[i]))) {
+!       if (seg->getType() == jbig2SegSymbolDict) {
+! 	inputSymbolDict = (JBIG2SymbolDict *)seg;
+! 	for (j = 0; j < inputSymbolDict->getSize(); ++j) {
+! 	  bitmaps[k++] = inputSymbolDict->getBitmap(j);
+! 	}
+        }
+      }
+    }
+***************
+*** 1510,1515 ****
+--- 1550,1558 ----
+      } else if (huffDH == 1) {
+        huffDHTable = huffTableE;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffDW == 0) {
+***************
+*** 1517,1533 ****
+--- 1560,1585 ----
+      } else if (huffDW == 1) {
+        huffDWTable = huffTableC;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffBMSize == 0) {
+        huffBMSizeTable = huffTableA;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffBMSizeTable =
+  	  ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffAggInst == 0) {
+        huffAggInstTable = huffTableA;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffAggInstTable =
+  	  ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+***************
+*** 1560,1566 ****
+    }
+  
+    // allocate symbol widths storage
+-   symWidths = NULL;
+    if (huff && !refAgg) {
+      symWidths = (Guint *)gmallocn(numNewSyms, sizeof(Guint));
+    }
+--- 1612,1617 ----
+***************
+*** 1602,1607 ****
+--- 1653,1662 ----
+  	goto syntaxError;
+        }
+        symWidth += dw;
++       if (i >= numNewSyms) {
++ 	error(getPos(), "Too many symbols in JBIG2 symbol dictionary");
++ 	goto syntaxError;
++       }
+  
+        // using a collective bitmap, so don't read a bitmap here
+        if (huff && !refAgg) {
+***************
+*** 1638,1643 ****
+--- 1693,1702 ----
+  	    arithDecoder->decodeInt(&refDX, iardxStats);
+  	    arithDecoder->decodeInt(&refDY, iardyStats);
+  	  }
++ 	  if (symID >= numInputSyms + i) {
++ 	    error(getPos(), "Invalid symbol ID in JBIG2 symbol dictionary");
++ 	    goto syntaxError;
++ 	  }
+  	  refBitmap = bitmaps[symID];
+  	  bitmaps[numInputSyms + i] =
+  	      readGenericRefinementRegion(symWidth, symHeight,
+***************
+*** 1704,1709 ****
+--- 1763,1774 ----
+      } else {
+        arithDecoder->decodeInt(&run, iaexStats);
+      }
++     if (i + run > numInputSyms + numNewSyms ||
++ 	(ex && j + run > numExSyms)) {
++       error(getPos(), "Too many exported symbols in JBIG2 symbol dictionary");
++       delete symbolDict;
++       goto syntaxError;
++     }
+      if (ex) {
+        for (cnt = 0; cnt < run; ++cnt) {
+  	symbolDict->setBitmap(j++, bitmaps[i++]->copy());
+***************
+*** 1713,1718 ****
+--- 1778,1788 ----
+      }
+      ex = !ex;
+    }
++   if (j != numExSyms) {
++     error(getPos(), "Too few symbols in JBIG2 symbol dictionary");
++     delete symbolDict;
++     goto syntaxError;
++   }
+  
+    for (i = 0; i < numNewSyms; ++i) {
+      delete bitmaps[numInputSyms + i];
+***************
+*** 1735,1740 ****
+--- 1805,1814 ----
+  
+    return gTrue;
+  
++  codeTableError:
++   error(getPos(), "Missing code table in JBIG2 symbol dictionary");
++   delete codeTables;
++ 
+   syntaxError:
+    for (i = 0; i < numNewSyms; ++i) {
+      if (bitmaps[numInputSyms + i]) {
+***************
+*** 1837,1842 ****
+--- 1911,1918 ----
+        }
+      } else {
+        error(getPos(), "Invalid segment reference in JBIG2 text region");
++       delete codeTables;
++       return;
+      }
+    }
+    symCodeLen = 0;
+***************
+*** 1871,1876 ****
+--- 1947,1955 ----
+      } else if (huffFS == 1) {
+        huffFSTable = huffTableG;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffFSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffDS == 0) {
+***************
+*** 1880,1885 ****
+--- 1959,1967 ----
+      } else if (huffDS == 2) {
+        huffDSTable = huffTableJ;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffDSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffDT == 0) {
+***************
+*** 1889,1894 ****
+--- 1971,1979 ----
+      } else if (huffDT == 2) {
+        huffDTTable = huffTableM;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffDTTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffRDW == 0) {
+***************
+*** 1896,1901 ****
+--- 1981,1989 ----
+      } else if (huffRDW == 1) {
+        huffRDWTable = huffTableO;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffRDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffRDH == 0) {
+***************
+*** 1903,1908 ****
+--- 1991,1999 ----
+      } else if (huffRDH == 1) {
+        huffRDHTable = huffTableO;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffRDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffRDX == 0) {
+***************
+*** 1910,1915 ****
+--- 2001,2009 ----
+      } else if (huffRDX == 1) {
+        huffRDXTable = huffTableO;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffRDXTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffRDY == 0) {
+***************
+*** 1917,1927 ****
+--- 2011,2027 ----
+      } else if (huffRDY == 1) {
+        huffRDYTable = huffTableO;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffRDYTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+      if (huffRSize == 0) {
+        huffRSizeTable = huffTableA;
+      } else {
++       if (i >= (Guint)codeTables->getLength()) {
++ 	goto codeTableError;
++       }
+        huffRSizeTable =
+  	  ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
+      }
+***************
+*** 2016,2023 ****
+--- 2116,2130 ----
+  
+    return;
+  
++  codeTableError:
++   error(getPos(), "Missing code table in JBIG2 text region");
++   gfree(codeTables);
++   delete syms;
++   return;
++ 
+   eofError:
+    error(getPos(), "Unexpected EOF in JBIG2 stream");
++   return;
+  }
+  
+  JBIG2Bitmap *JBIG2Stream::readTextRegion(GBool huff, GBool refine,
+***************
+*** 2324,2331 ****
+      error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+      return;
+    }
+!   seg = findSegment(refSegs[0]);
+!   if (seg->getType() != jbig2SegPatternDict) {
+      error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+      return;
+    }
+--- 2431,2438 ----
+      error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+      return;
+    }
+!   if (!(seg = findSegment(refSegs[0])) ||
+!       seg->getType() != jbig2SegPatternDict) {
+      error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+      return;
+    }
+***************
+*** 2483,2489 ****
+  
+    // read the bitmap
+    bitmap = readGenericBitmap(mmr, w, h, templ, tpgdOn, gFalse,
+! 			     NULL, atx, aty, mmr ? 0 : length - 18);
+  
+    // combine the region bitmap into the page bitmap
+    if (imm) {
+--- 2590,2596 ----
+  
+    // read the bitmap
+    bitmap = readGenericBitmap(mmr, w, h, templ, tpgdOn, gFalse,
+! 			     NULL, atx, aty, mmr ? length - 18 : 0);
+  
+    // combine the region bitmap into the page bitmap
+    if (imm) {
+***************
+*** 2505,2510 ****
+--- 2612,2654 ----
+    error(getPos(), "Unexpected EOF in JBIG2 stream");
+  }
+  
++ inline void JBIG2Stream::mmrAddPixels(int a1, int blackPixels,
++ 				      int *codingLine, int *a0i, int w) {
++   if (a1 > codingLine[*a0i]) {
++     if (a1 > w) {
++       error(getPos(), "JBIG2 MMR row is wrong length ({0:d})", a1);
++       a1 = w;
++     }
++     if ((*a0i & 1) ^ blackPixels) {
++       ++*a0i;
++     }
++     codingLine[*a0i] = a1;
++   }
++ }
++ 
++ inline void JBIG2Stream::mmrAddPixelsNeg(int a1, int blackPixels,
++ 					 int *codingLine, int *a0i, int w) {
++   if (a1 > codingLine[*a0i]) {
++     if (a1 > w) {
++       error(getPos(), "JBIG2 MMR row is wrong length ({0:d})", a1);
++       a1 = w;
++     }
++     if ((*a0i & 1) ^ blackPixels) {
++       ++*a0i;
++     }
++     codingLine[*a0i] = a1;
++   } else if (a1 < codingLine[*a0i]) {
++     if (a1 < 0) {
++       error(getPos(), "Invalid JBIG2 MMR code");
++       a1 = 0;
++     }
++     while (*a0i > 0 && a1 <= codingLine[*a0i - 1]) {
++       --*a0i;
++     }
++     codingLine[*a0i] = a1;
++   }
++ }
++ 
+  JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h,
+  					    int templ, GBool tpgdOn,
+  					    GBool useSkip, JBIG2Bitmap *skip,
+***************
+*** 2517,2523 ****
+    JBIG2BitmapPtr atPtr0, atPtr1, atPtr2, atPtr3;
+    int *refLine, *codingLine;
+    int code1, code2, code3;
+!   int x, y, a0, pix, i, refI, codingI;
+  
+    bitmap = new JBIG2Bitmap(0, w, h);
+    bitmap->clearToZero();
+--- 2661,2667 ----
+    JBIG2BitmapPtr atPtr0, atPtr1, atPtr2, atPtr3;
+    int *refLine, *codingLine;
+    int code1, code2, code3;
+!   int x, y, a0i, b1i, blackPixels, pix, i;
+  
+    bitmap = new JBIG2Bitmap(0, w, h);
+    bitmap->clearToZero();
+***************
+*** 2527,2535 ****
+    if (mmr) {
+  
+      mmrDecoder->reset();
+      refLine = (int *)gmallocn(w + 2, sizeof(int));
+!     codingLine = (int *)gmallocn(w + 2, sizeof(int));
+!     codingLine[0] = codingLine[1] = w;
+  
+      for (y = 0; y < h; ++y) {
+  
+--- 2671,2688 ----
+    if (mmr) {
+  
+      mmrDecoder->reset();
++     if (w > INT_MAX - 2) {
++       error(getPos(), "Bad width in JBIG2 generic bitmap");
++       // force a call to gmalloc(-1), which will throw an exception
++       w = -3;
++     }
++     // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = w
++     // ---> max codingLine size = w + 1
++     // refLine has one extra guard entry at the end
++     // ---> max refLine size = w + 2
++     codingLine = (int *)gmallocn(w + 1, sizeof(int));
+      refLine = (int *)gmallocn(w + 2, sizeof(int));
+!     codingLine[0] = w;
+  
+      for (y = 0; y < h; ++y) {
+  
+***************
+*** 2537,2664 ****
+        for (i = 0; codingLine[i] < w; ++i) {
+  	refLine[i] = codingLine[i];
+        }
+!       refLine[i] = refLine[i + 1] = w;
+  
+        // decode a line
+!       refI = 0;     // b1 = refLine[refI]
+!       codingI = 0;  // a1 = codingLine[codingI]
+!       a0 = 0;
+!       do {
+  	code1 = mmrDecoder->get2DCode();
+  	switch (code1) {
+  	case twoDimPass:
+! 	  if (refLine[refI] < w) {
+! 	    a0 = refLine[refI + 1];
+! 	    refI += 2;
+! 	  }
+! 	  break;
+  	case twoDimHoriz:
+! 	  if (codingI & 1) {
+! 	    code1 = 0;
+! 	    do {
+! 	      code1 += code3 = mmrDecoder->getBlackCode();
+! 	    } while (code3 >= 64);
+! 	    code2 = 0;
+! 	    do {
+! 	      code2 += code3 = mmrDecoder->getWhiteCode();
+! 	    } while (code3 >= 64);
+! 	  } else {
+! 	    code1 = 0;
+! 	    do {
+! 	      code1 += code3 = mmrDecoder->getWhiteCode();
+! 	    } while (code3 >= 64);
+! 	    code2 = 0;
+! 	    do {
+! 	      code2 += code3 = mmrDecoder->getBlackCode();
+! 	    } while (code3 >= 64);
+! 	  }
+! 	  if (code1 > 0 || code2 > 0) {
+! 	    a0 = codingLine[codingI++] = a0 + code1;
+! 	    a0 = codingLine[codingI++] = a0 + code2;
+! 	    while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	      refI += 2;
+! 	    }
+! 	  }
+! 	  break;
+! 	case twoDimVert0:
+! 	  a0 = codingLine[codingI++] = refLine[refI];
+! 	  if (refLine[refI] < w) {
+! 	    ++refI;
+! 	  }
+! 	  break;
+! 	case twoDimVertR1:
+! 	  a0 = codingLine[codingI++] = refLine[refI] + 1;
+! 	  if (refLine[refI] < w) {
+! 	    ++refI;
+! 	    while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	      refI += 2;
+! 	    }
+! 	  }
+! 	  break;
+! 	case twoDimVertR2:
+! 	  a0 = codingLine[codingI++] = refLine[refI] + 2;
+! 	  if (refLine[refI] < w) {
+! 	    ++refI;
+! 	    while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	      refI += 2;
+! 	    }
+! 	  }
+! 	  break;
+  	case twoDimVertR3:
+! 	  a0 = codingLine[codingI++] = refLine[refI] + 3;
+! 	  if (refLine[refI] < w) {
+! 	    ++refI;
+! 	    while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	      refI += 2;
+! 	    }
+! 	  }
+! 	  break;
+! 	case twoDimVertL1:
+! 	  a0 = codingLine[codingI++] = refLine[refI] - 1;
+! 	  if (refI > 0) {
+! 	    --refI;
+! 	  } else {
+! 	    ++refI;
+! 	  }
+! 	  while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	    refI += 2;
+! 	  }
+! 	  break;
+! 	case twoDimVertL2:
+! 	  a0 = codingLine[codingI++] = refLine[refI] - 2;
+! 	  if (refI > 0) {
+! 	    --refI;
+! 	  } else {
+! 	    ++refI;
+! 	  }
+! 	  while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	    refI += 2;
+! 	  }
+! 	  break;
+  	case twoDimVertL3:
+! 	  a0 = codingLine[codingI++] = refLine[refI] - 3;
+! 	  if (refI > 0) {
+! 	    --refI;
+! 	  } else {
+! 	    ++refI;
+! 	  }
+! 	  while (refLine[refI] <= a0 && refLine[refI] < w) {
+! 	    refI += 2;
+! 	  }
+! 	  break;
+  	default:
+  	  error(getPos(), "Illegal code in JBIG2 MMR bitmap data");
+  	  break;
+  	}
+!       } while (a0 < w);
+!       codingLine[codingI++] = w;
+  
+        // convert the run lengths to a bitmap line
+        i = 0;
+!       while (codingLine[i] < w) {
+  	for (x = codingLine[i]; x < codingLine[i+1]; ++x) {
+  	  bitmap->setPixel(x, y);
+  	}
+  	i += 2;
+        }
+      }
+--- 2690,2846 ----
+        for (i = 0; codingLine[i] < w; ++i) {
+  	refLine[i] = codingLine[i];
+        }
+!       refLine[i++] = w;
+!       refLine[i] = w;
+  
+        // decode a line
+!       codingLine[0] = 0;
+!       a0i = 0;
+!       b1i = 0;
+!       blackPixels = 0;
+!       // invariant:
+!       // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] <= w
+!       // exception at left edge:
+!       //   codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
+!       // exception at right edge:
+!       //   refLine[b1i] = refLine[b1i+1] = w is possible
+!       while (codingLine[a0i] < w) {
+  	code1 = mmrDecoder->get2DCode();
+  	switch (code1) {
+  	case twoDimPass:
+!           mmrAddPixels(refLine[b1i + 1], blackPixels, codingLine, &a0i, w);
+!           if (refLine[b1i + 1] < w) {
+!             b1i += 2;
+!           }
+!           break;
+  	case twoDimHoriz:
+!           code1 = code2 = 0;
+!           if (blackPixels) {
+!             do {
+!               code1 += code3 = mmrDecoder->getBlackCode();
+!             } while (code3 >= 64);
+!             do {
+!               code2 += code3 = mmrDecoder->getWhiteCode();
+!             } while (code3 >= 64);
+!           } else {
+!             do {
+!               code1 += code3 = mmrDecoder->getWhiteCode();
+!             } while (code3 >= 64);
+!             do {
+!               code2 += code3 = mmrDecoder->getBlackCode();
+!             } while (code3 >= 64);
+!           }
+!           mmrAddPixels(codingLine[a0i] + code1, blackPixels,
+! 		       codingLine, &a0i, w);
+!           if (codingLine[a0i] < w) {
+!             mmrAddPixels(codingLine[a0i] + code2, blackPixels ^ 1,
+! 			 codingLine, &a0i, w);
+!           }
+!           while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!             b1i += 2;
+!           }
+!           break;
+  	case twoDimVertR3:
+!           mmrAddPixels(refLine[b1i] + 3, blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             ++b1i;
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+! 	case twoDimVertR2:
+!           mmrAddPixels(refLine[b1i] + 2, blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             ++b1i;
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+! 	case twoDimVertR1:
+!           mmrAddPixels(refLine[b1i] + 1, blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             ++b1i;
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+! 	case twoDimVert0:
+!           mmrAddPixels(refLine[b1i], blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             ++b1i;
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+  	case twoDimVertL3:
+!           mmrAddPixelsNeg(refLine[b1i] - 3, blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             if (b1i > 0) {
+!               --b1i;
+!             } else {
+!               ++b1i;
+!             }
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+! 	case twoDimVertL2:
+!           mmrAddPixelsNeg(refLine[b1i] - 2, blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             if (b1i > 0) {
+!               --b1i;
+!             } else {
+!               ++b1i;
+!             }
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+! 	case twoDimVertL1:
+!           mmrAddPixelsNeg(refLine[b1i] - 1, blackPixels, codingLine, &a0i, w);
+!           blackPixels ^= 1;
+!           if (codingLine[a0i] < w) {
+!             if (b1i > 0) {
+!               --b1i;
+!             } else {
+!               ++b1i;
+!             }
+!             while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
+!               b1i += 2;
+!             }
+!           }
+!           break;
+! 	case EOF:
+!           mmrAddPixels(w, 0, codingLine, &a0i, w);
+!           break;
+  	default:
+  	  error(getPos(), "Illegal code in JBIG2 MMR bitmap data");
++           mmrAddPixels(w, 0, codingLine, &a0i, w);
+  	  break;
+  	}
+!       }
+  
+        // convert the run lengths to a bitmap line
+        i = 0;
+!       while (1) {
+  	for (x = codingLine[i]; x < codingLine[i+1]; ++x) {
+  	  bitmap->setPixel(x, y);
+  	}
++ 	if (codingLine[i+1] >= w || codingLine[i+2] >= w) {
++ 	  break;
++ 	}
+  	i += 2;
+        }
+      }
+***************
+*** 2706,2712 ****
+  	  ltp = !ltp;
+  	}
+  	if (ltp) {
+! 	  bitmap->duplicateRow(y, y-1);
+  	  continue;
+  	}
+        }
+--- 2888,2896 ----
+  	  ltp = !ltp;
+  	}
+  	if (ltp) {
+! 	  if (y > 0) {
+! 	    bitmap->duplicateRow(y, y-1);
+! 	  }
+  	  continue;
+  	}
+        }
+***************
+*** 2909,2916 ****
+      return;
+    }
+    if (nRefSegs == 1) {
+!     seg = findSegment(refSegs[0]);
+!     if (seg->getType() != jbig2SegBitmap) {
+        error(getPos(), "Bad bitmap reference in JBIG2 generic refinement segment");
+        return;
+      }
+--- 3093,3100 ----
+      return;
+    }
+    if (nRefSegs == 1) {
+!     if (!(seg = findSegment(refSegs[0])) ||
+! 	seg->getType() != jbig2SegBitmap) {
+        error(getPos(), "Bad bitmap reference in JBIG2 generic refinement segment");
+        return;
+      }
+***************
+*** 3004,3009 ****
+--- 3188,3197 ----
+  	tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2);
+  	tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2);
+  	tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2);
++       } else {
++ 	tpgrCXPtr0.p = tpgrCXPtr1.p = tpgrCXPtr2.p = NULL; // make gcc happy
++ 	tpgrCXPtr0.shift = tpgrCXPtr1.shift = tpgrCXPtr2.shift = 0;
++ 	tpgrCXPtr0.x = tpgrCXPtr1.x = tpgrCXPtr2.x = 0;
+        }
+  
+        for (x = 0; x < w; ++x) {
+***************
+*** 3075,3080 ****
+--- 3263,3272 ----
+  	tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2);
+  	tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2);
+  	tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2);
++       } else {
++ 	tpgrCXPtr0.p = tpgrCXPtr1.p = tpgrCXPtr2.p = NULL; // make gcc happy
++ 	tpgrCXPtr0.shift = tpgrCXPtr1.shift = tpgrCXPtr2.shift = 0;
++ 	tpgrCXPtr0.x = tpgrCXPtr1.x = tpgrCXPtr2.x = 0;
+        }
+  
+        for (x = 0; x < w; ++x) {
+diff -r -c xpdf-3.02.orig/xpdf/JBIG2Stream.h xpdf-3.02/xpdf/JBIG2Stream.h
+*** xpdf-3.02.orig/xpdf/JBIG2Stream.h	Tue Feb 27 14:05:52 2007
+--- xpdf-3.02/xpdf/JBIG2Stream.h	Tue Mar 31 10:50:07 2009
+***************
+*** 78,83 ****
+--- 78,87 ----
+  			     Guint *refSegs, Guint nRefSegs);
+    void readGenericRegionSeg(Guint segNum, GBool imm,
+  			    GBool lossless, Guint length);
++   void mmrAddPixels(int a1, int blackPixels,
++ 		    int *codingLine, int *a0i, int w);
++   void mmrAddPixelsNeg(int a1, int blackPixels,
++ 		       int *codingLine, int *a0i, int w);
+    JBIG2Bitmap *readGenericBitmap(GBool mmr, int w, int h,
+  				 int templ, GBool tpgdOn,
+  				 GBool useSkip, JBIG2Bitmap *skip,