2006-02-09 Kristian Høgsberg <krh@redhat.com>
* configure.ac: Bump realease to 0.4.5.
* NEWS: Sum up changes.
* splash/Splash.cc: Add fix for CVE-2006-0301.
diff --git a/ChangeLog b/ChangeLog
index 950e318..894d757 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2006-02-09 Kristian Høgsberg <krh@redhat.com>
+
+ * configure.ac: Bump realease to 0.4.5.
+
+ * NEWS: Sum up changes.
+
+ * splash/Splash.cc: Add fix for CVE-2006-0301.
+
2006-01-10 Kristian Høgsberg <krh@redhat.com>
* configure.ac: Bump realease to 0.4.4.
diff --git a/NEWS b/NEWS
index 8fa2289..56ce797 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Release 0.4.5
+
+ - Security update; CVE-2006-0301.
+
Release 0.4.4
- Security update; CVE-2005-3624, CVE-2005-3625, CVE-2005-3627.
diff --git a/configure.ac b/configure.ac
index c3e1321..081d923 100644
--- a/configure.ac
+++ b/configure.ac
@@ -113,7 +113,7 @@
AC_PREREQ(2.59)
-AC_INIT(poppler, 0.4.4)
+AC_INIT(poppler, 0.4.5)
AM_INIT_AUTOMAKE(AC_PACKAGE_NAME, AC_PACKAGE_VERSION)
AM_CONFIG_HEADER(config.h)
AM_CONFIG_HEADER(poppler/poppler-config.h)
diff --git a/splash/Splash.cc b/splash/Splash.cc
index d29215a..7bd4137 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -728,6 +728,10 @@
SplashRGB8P *rgb8p;
SplashBGR8P *bgr8;
+ if ( (unsigned) x >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
if (noClip || state->clip->test(x, y)) {
switch (bitmap->mode) {
case splashModeMono1:
@@ -766,6 +770,10 @@
SplashRGB8P *rgb8p;
SplashBGR8P *bgr8;
+ if ( (unsigned) x >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
if (noClip || state->clip->test(x, y)) {
color = pattern->getColor(x, y);
switch (bitmap->mode) {
@@ -810,6 +818,11 @@
SplashMono1 mask1;
int i, j, n;
+ if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
n = x1 - x0 + 1;
switch (bitmap->mode) {
@@ -909,6 +922,11 @@
SplashMono1 mask1;
int i, j, n;
+ if ((unsigned) x0 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) x1 >= (unsigned) bitmap->getWidth() ||
+ (unsigned) y >= (unsigned) bitmap->getHeight())
+ return;
+
n = x1 - x0 + 1;
switch (bitmap->mode) {
