# ChangeLog for app-office/koffice
# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/ChangeLog,v 1.82 2004/12/22 19:45:09 carlo Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/ChangeLog,v 1.83 2004/12/22 20:06:27 carlo Exp $
+
+ 22 Dec 2004; Carsten Lohrke <carlo@gentoo.org>
+ files/koffice_1_3_xpdf_buffer_overflow.diff:
+ oops, forgot to merge the diffs
*koffice-1.3.5-r1 (22 Dec 2004)
MD5 1f16f48b7c9dfce42b1ecfb1d96c3ff9 koffice-1.3.3-r2.ebuild 1148
MD5 1fd88e400d0cf26a16ea3397561568f9 koffice-1.3.4-r1.ebuild 989
MD5 13a18da5f8ea71516aac28003d0f4172 koffice-1.3.5.ebuild 919
-MD5 63902a93d8e90e02e0cd1ce7db7fc4e9 ChangeLog 11924
+MD5 792100a47149b02de8eefa7a1d48ad4e ChangeLog 12055
MD5 96a4184e1e3325923219a5f96a5511a5 metadata.xml 163
MD5 20d32402fa6f6883dccb63cf1826a15f files/koffice_1_3_4_xpdf_security_integer_overflow.diff 3393
-MD5 bf8cc9885832c30290469b3a09e96b6a files/koffice_1_3_xpdf_buffer_overflow.diff 678
+MD5 77399be6733ffca4ed1142ab319c1453 files/koffice_1_3_xpdf_buffer_overflow.diff 1808
MD5 12452317cab5461eb911114062f2cce2 files/digest-koffice-1.3.5 68
MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3-r2 68
MD5 d261da2eaab2f46cd2f06609e5f41885 files/digest-koffice-1.3.4-r1 68
maskObj.arrayGet(i, &obj1);
maskColors[i] = obj1.getInt();
obj1.free();
+===================================================================
+RCS file: /home/kde/koffice/filters/kword/pdf/xpdf/xpdf/GfxState.cc,v
+retrieving revision 1.3
+retrieving revision 1.3.2.2
+diff -u -r1.3 -r1.3.2.2
+--- filters/kword/pdf/xpdf/xpdf/GfxState.cc 2003/01/25 23:17:44 1.3
++++ filters/kword/pdf/xpdf/xpdf/GfxState.cc 2004/12/22 13:50:53 1.3.2.2
+@@ -682,6 +682,11 @@
+ }
+ nCompsA = obj2.getInt();
+ obj2.free();
++ if (nCompsA > gfxColorMaxComps) {
++ error(-1, "ICCBased color space with too many (%d > %d) components",
++ nCompsA, gfxColorMaxComps);
++ nCompsA = gfxColorMaxComps;
++ }
+ if (dict->lookup("Alternate", &obj2)->isNull() ||
+ !(altA = GfxColorSpace::parse(&obj2))) {
+ switch (nCompsA) {
+@@ -1023,6 +1028,11 @@
+ goto err2;
+ }
+ nCompsA = obj1.arrayGetLength();
++ if (nCompsA > gfxColorMaxComps) {
++ error(-1, "DeviceN color space with too many (%d > %d) components",
++ nCompsA, gfxColorMaxComps);
++ nCompsA = gfxColorMaxComps;
++ }
+ for (i = 0; i < nCompsA; ++i) {
+ if (!obj1.arrayGet(i, &obj2)->isName()) {
+ error(-1, "Bad DeviceN color space (names)");