|
 |
d35507 |
diff -up cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx.CVE-2013-6475 cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx
|
|
|
d35507 |
--- cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx.CVE-2013-6475 2014-01-20 13:32:28.906801955 +0000
|
|
|
d35507 |
+++ cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx 2014-01-20 13:34:03.581403757 +0000
|
|
|
d35507 |
@@ -1094,7 +1094,7 @@ void OPVPSplash::fillGlyph(SplashCoord x
|
|
|
d35507 |
|
|
|
d35507 |
opvpbytes = (m+3)/4;
|
|
|
d35507 |
opvpbytes *= 4;
|
|
|
d35507 |
- bp = (Guchar *)gmalloc(opvpbytes*glyph->h);
|
|
|
d35507 |
+ bp = (Guchar *)gmallocn(opvpbytes, glyph->h);
|
|
|
d35507 |
for (i = 0;i < glyph->h;i++) {
|
|
|
d35507 |
memcpy(bp+i*opvpbytes,glyph->data+i*m,m);
|
|
|
d35507 |
}
|
|
|
d35507 |
@@ -1238,8 +1238,8 @@ SplashError OPVPSplash::fillImageMaskFas
|
|
|
d35507 |
/* align 4 */
|
|
|
d35507 |
opvpbytes = (opvpbytes+3)/4;
|
|
|
d35507 |
opvpbytes *= 4;
|
|
|
d35507 |
- buf = (Guchar *)gmalloc(opvpbytes*h);
|
|
|
d35507 |
- lineBuf = (SplashColorPtr)gmalloc(opvpbytes*8);
|
|
|
d35507 |
+ buf = (Guchar *)gmallocn(opvpbytes, h);
|
|
|
d35507 |
+ lineBuf = (SplashColorPtr)gmallocn(opvpbytes, 8);
|
|
|
d35507 |
|
|
|
d35507 |
for (i = 0;i < h;i++) {
|
|
|
d35507 |
int k;
|
|
|
d35507 |
@@ -1417,7 +1417,7 @@ SplashError OPVPSplash::fillImageMask(Sp
|
|
|
d35507 |
imat[3] = mat[0]/det;
|
|
|
d35507 |
|
|
|
d35507 |
/* read source image */
|
|
|
d35507 |
- pixBuf = (SplashColorPtr)gmalloc(h * w);
|
|
|
d35507 |
+ pixBuf = (SplashColorPtr)gmallocn(h, w);
|
|
|
d35507 |
|
|
|
d35507 |
p = pixBuf;
|
|
|
d35507 |
for (i = 0; i < h; ++i) {
|
|
|
d35507 |
@@ -1571,7 +1571,7 @@ SplashError OPVPSplash::drawImageNotShea
|
|
|
d35507 |
hs = h-1;
|
|
|
d35507 |
he = -1;
|
|
|
d35507 |
}
|
|
|
d35507 |
- buf = (Guchar *)gmalloc(opvpbytes*h);
|
|
|
d35507 |
+ buf = (Guchar *)gmallocn(opvpbytes, h);
|
|
|
d35507 |
lineBuf = (SplashColorPtr)gmalloc(lineBufSize);
|
|
|
d35507 |
switch (colorMode) {
|
|
|
d35507 |
case splashModeMono1:
|
|
|
d35507 |
@@ -1734,7 +1734,7 @@ SplashError OPVPSplash::drawImageFastWit
|
|
|
d35507 |
return splashErrOPVP;
|
|
|
d35507 |
break;
|
|
|
d35507 |
}
|
|
|
d35507 |
- buf = (Guchar *)gmalloc(opvpbytes*h);
|
|
|
d35507 |
+ buf = (Guchar *)gmallocn(opvpbytes, h);
|
|
|
d35507 |
|
|
|
d35507 |
switch (colorMode) {
|
|
|
d35507 |
case splashModeMono1:
|
|
|
d35507 |
@@ -1960,7 +1960,7 @@ SplashError OPVPSplash::drawImage(Splash
|
|
|
d35507 |
}
|
|
|
d35507 |
|
|
|
d35507 |
/* read source image */
|
|
|
d35507 |
- pixBuf = (SplashColorPtr)gmalloc(h * linesize);
|
|
|
d35507 |
+ pixBuf = (SplashColorPtr)gmallocn(h, linesize);
|
|
|
d35507 |
|
|
|
d35507 |
p = pixBuf;
|
|
|
d35507 |
for (i = 0; i < h; ++i) {
|
|
|
d35507 |
diff -up cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx.CVE-2013-6475 cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx
|
|
|
d35507 |
--- cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx.CVE-2013-6475 2014-01-20 13:34:26.782551214 +0000
|
|
|
d35507 |
+++ cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx 2014-01-20 13:37:30.670719614 +0000
|
|
|
d35507 |
@@ -147,9 +147,9 @@ T3FontCache::T3FontCache(Ref *fontIDA, d
|
|
|
d35507 |
} else {
|
|
|
d35507 |
cacheSets = 1;
|
|
|
d35507 |
}
|
|
|
d35507 |
- cacheData = (Guchar *)gmalloc(cacheSets * cacheAssoc * glyphSize);
|
|
|
d35507 |
- cacheTags = (T3FontCacheTag *)gmalloc(cacheSets * cacheAssoc *
|
|
|
d35507 |
- sizeof(T3FontCacheTag));
|
|
|
d35507 |
+ cacheData = (Guchar *)gmallocn3(cacheSets, cacheAssoc, glyphSize);
|
|
|
d35507 |
+ cacheTags = (T3FontCacheTag *)gmallocn3(cacheSets, cacheAssoc,
|
|
|
d35507 |
+ sizeof(T3FontCacheTag));
|
|
|
d35507 |
for (i = 0; i < cacheSets * cacheAssoc; ++i) {
|
|
|
d35507 |
cacheTags[i].mru = i & (cacheAssoc - 1);
|
|
|
d35507 |
}
|
|
|
d35507 |
@@ -1424,7 +1424,7 @@ void OPVPOutputDev::drawImage(GfxState *
|
|
|
d35507 |
}
|
|
|
d35507 |
break;
|
|
|
d35507 |
case splashModeRGB8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(3, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getRGB(&pix, &rgb);
|
|
|
d35507 |
@@ -1434,7 +1434,7 @@ void OPVPOutputDev::drawImage(GfxState *
|
|
|
d35507 |
}
|
|
|
d35507 |
break;
|
|
|
d35507 |
case splashModeBGR8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(3, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getRGB(&pix, &rgb);
|
|
|
d35507 |
@@ -1445,7 +1445,7 @@ void OPVPOutputDev::drawImage(GfxState *
|
|
|
d35507 |
break;
|
|
|
d35507 |
#if SPLASH_CMYK
|
|
|
d35507 |
case splashModeCMYK8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(4, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getCMYK(&pix, &cmyk);
|
|
|
d35507 |
@@ -1680,7 +1680,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
|
|
|
d35507 |
}
|
|
|
d35507 |
break;
|
|
|
d35507 |
case splashModeRGB8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(3, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getRGB(&pix, &rgb);
|
|
|
d35507 |
@@ -1690,7 +1690,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
|
|
|
d35507 |
}
|
|
|
d35507 |
break;
|
|
|
d35507 |
case splashModeBGR8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(3, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getRGB(&pix, &rgb);
|
|
|
d35507 |
@@ -1701,7 +1701,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
|
|
|
d35507 |
break;
|
|
|
d35507 |
#if SPLASH_CMYK
|
|
|
d35507 |
case splashModeCMYK8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(4, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getCMYK(&pix, &cmyk);
|
|
|
d35507 |
@@ -1847,7 +1847,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
|
|
|
d35507 |
}
|
|
|
d35507 |
break;
|
|
|
d35507 |
case splashModeRGB8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(3, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getRGB(&pix, &rgb);
|
|
|
d35507 |
@@ -1857,7 +1857,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
|
|
|
d35507 |
}
|
|
|
d35507 |
break;
|
|
|
d35507 |
case splashModeBGR8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(3, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getRGB(&pix, &rgb);
|
|
|
d35507 |
@@ -1868,7 +1868,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
|
|
|
d35507 |
break;
|
|
|
d35507 |
#if SPLASH_CMYK
|
|
|
d35507 |
case splashModeCMYK8:
|
|
|
d35507 |
- imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
|
|
|
d35507 |
+ imgData.lookup = (SplashColorPtr)gmallocn(4, n);
|
|
|
d35507 |
for (i = 0; i < n; ++i) {
|
|
|
d35507 |
pix = (Guchar)i;
|
|
|
d35507 |
colorMap->getCMYK(&pix, &cmyk);
|