SplashOutputDev::tilingPatternFill: Fix crash on broken file
Issue #802
diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
index 544f132..3d2befc 100644
--- a/poppler/SplashOutputDev.cc
+++ b/poppler/SplashOutputDev.cc
@@ -4581,6 +4581,10 @@
surface_width = (int) ceil (fabs(kx));
surface_height = (int) ceil (fabs(ky));
// adjust repeat values to completely fill region
+ if (unlikely(surface_width == 0 || surface_height == 0)) {
+ state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]);
+ return false;
+ }
repeatX = result_width / surface_width;
repeatY = result_height / surface_height;
if (surface_width * repeatX < result_width)
