-fix embedded font handling (CVE-2008-1693), patch from Ubuntu,
 bump PKGREVISION
-being here, add a patch from upstream CVS which fixes display
 of 16-bit colors


(drochner)

$NetBSD: patch-aj,v 1.1 2008/04/18 14:03:54 drochner Exp $

--- poppler/Object.h.orig	2007-12-20 19:40:06.000000000 +0100
+++ poppler/Object.h
@@ -66,17 +66,18 @@ enum ObjType {
 //------------------------------------------------------------------------
 
 #ifdef DEBUG_MEM
-#define initObj(t) ++numAlloc[type = t]
+#define initObj(t) zeroUnion(); ++numAlloc[type = t]
 #else
-#define initObj(t) type = t
+#define initObj(t) zeroUnion(); type = t
 #endif
 
 class Object {
 public:
-
+  // attempt to clear the anonymous union
+  void zeroUnion() { this->name = NULL; }
   // Default constructor.
   Object():
-    type(objNone) {}
+    type(objNone) { zeroUnion(); }
 
   // Initialize an object.
   Object *initBool(GBool boolnA)
@@ -223,16 +224,16 @@ private:
 #include "Array.h"
 
 inline int Object::arrayGetLength()
-  { return array->getLength(); }
+  { if (type != objArray) return 0; return array->getLength(); }
 
 inline void Object::arrayAdd(Object *elem)
-  { array->add(elem); }
+  { if (type == objArray) array->add(elem); }
 
 inline Object *Object::arrayGet(int i, Object *obj)
-  { return array->get(i, obj); }
+  { if (type != objArray) return obj->initNull(); return array->get(i, obj); }
 
 inline Object *Object::arrayGetNF(int i, Object *obj)
-  { return array->getNF(i, obj); }
+  { if (type != objArray) return obj->initNull(); return array->getNF(i, obj); }
 
 //------------------------------------------------------------------------
 // Dict accessors.
@@ -241,34 +242,34 @@ inline Object *Object::arrayGetNF(int i,
 #include "Dict.h"
 
 inline int Object::dictGetLength()
-  { return dict->getLength(); }
+  { if (type != objDict) return 0; return dict->getLength(); }
 
 inline void Object::dictAdd(char *key, Object *val)
-  { dict->add(key, val); }
+  { if (type == objDict) dict->add(key, val); }
 
 inline void Object::dictSet(char *key, Object *val)
- 	{ dict->set(key, val); }
+ 	{ if (type == objDict) dict->set(key, val); }
 
 inline GBool Object::dictIs(char *dictType)
-  { return dict->is(dictType); }
+  { return (type == objDict) && dict->is(dictType); }
 
 inline GBool Object::isDict(char *dictType)
   { return type == objDict && dictIs(dictType); }
 
 inline Object *Object::dictLookup(char *key, Object *obj)
-  { return dict->lookup(key, obj); }
+  { if (type != objDict) return obj->initNull(); return dict->lookup(key, obj); }
 
 inline Object *Object::dictLookupNF(char *key, Object *obj)
-  { return dict->lookupNF(key, obj); }
+  { if (type != objDict) return obj->initNull(); return dict->lookupNF(key, obj); }
 
 inline char *Object::dictGetKey(int i)
-  { return dict->getKey(i); }
+  { if (type != objDict) return NULL; return dict->getKey(i); }
 
 inline Object *Object::dictGetVal(int i, Object *obj)
-  { return dict->getVal(i, obj); }
+  { if (type != objDict) return obj->initNull(); return dict->getVal(i, obj); }
 
 inline Object *Object::dictGetValNF(int i, Object *obj)
-  { return dict->getValNF(i, obj); }
+  { if (type != objDict) return obj->initNull(); return dict->getValNF(i, obj); }
 
 //------------------------------------------------------------------------
 // Stream accessors.
@@ -277,33 +278,33 @@ inline Object *Object::dictGetValNF(int 
 #include "Stream.h"
 
 inline GBool Object::streamIs(char *dictType)
-  { return stream->getDict()->is(dictType); }
+  { return (type == objStream) && stream->getDict()->is(dictType); }
 
 inline GBool Object::isStream(char *dictType)
-  { return type == objStream && streamIs(dictType); }
+  { return (type == objStream) && streamIs(dictType); }
 
 inline void Object::streamReset()
-  { stream->reset(); }
+  { if (type == objStream) stream->reset(); }
 
 inline void Object::streamClose()
-  { stream->close(); }
+  { if (type == objStream) stream->close(); }
 
 inline int Object::streamGetChar()
-  { return stream->getChar(); }
+  { if (type != objStream) return EOF; return stream->getChar(); }
 
 inline int Object::streamLookChar()
-  { return stream->lookChar(); }
+  { if (type != objStream) return EOF; return stream->lookChar(); }
 
 inline char *Object::streamGetLine(char *buf, int size)
-  { return stream->getLine(buf, size); }
+  { if (type != objStream) return NULL; return stream->getLine(buf, size); }
 
 inline Guint Object::streamGetPos()
-  { return stream->getPos(); }
+  { if (type != objStream) return 0; return stream->getPos(); }
 
 inline void Object::streamSetPos(Guint pos, int dir)
-  { stream->setPos(pos, dir); }
+  { if (type == objStream) stream->setPos(pos, dir); }
 
 inline Dict *Object::streamGetDict()
-  { return stream->getDict(); }
+  { if (type != objStream) return NULL; return stream->getDict(); }
 
 #endif

$NetBSD: patch-ak,v 1.1 2008/04/18 14:03:54 drochner Exp $

--- poppler/GfxState.cc.orig	2008-02-09 12:46:17.000000000 +0100
+++ poppler/GfxState.cc
@@ -3349,6 +3349,12 @@ GfxImageColorMap::GfxImageColorMap(int b
   maxPixel = (1 << bits) - 1;
   colorSpace = colorSpaceA;
 
+  // this is a hack to support 16 bits images, everywhere
+  // we assume a component fits in 8 bits, with this hack
+  // we treat 16 bit images as 8 bit ones until it's fixed correctly.
+  // The hack has another part on ImageStream::getLine
+  if (maxPixel > 255) maxPixel = 255;
+
   // initialize
   for (k = 0; k < gfxColorMaxComps; ++k) {
     lookup[k] = NULL;

$NetBSD: patch-al,v 1.1 2008/04/18 14:03:54 drochner Exp $

--- poppler/Stream.cc.orig	2008-03-22 14:57:24.000000000 +0100
+++ poppler/Stream.cc
@@ -428,6 +428,15 @@ Guchar *ImageStream::getLine() {
     for (i = 0; i < nVals; ++i) {
       imgLine[i] = str->getChar();
     }
+  } else if (nBits == 16) {
+    // this is a hack to support 16 bits images, everywhere
+    // we assume a component fits in 8 bits, with this hack
+    // we treat 16 bit images as 8 bit ones until it's fixed correctly.
+    // The hack has another part on GfxImageColorMap::GfxImageColorMap
+    for (i = 0; i < nVals; ++i) {
+      imgLine[i] = str->getChar();
+      str->getChar();
+    }
   } else {
     bitMask = (1 << nBits) - 1;
     buf = 0;