Version bumbed. Added xpdf security patch, bug #196673.

(Portage version: 2.1.3.19)

3 files changed, 720 insertions, 0 deletions

diff --git a/app-text/ptex/files/digest-ptex-3.1.10_p20071203 b/app-text/ptex/files/digest-ptex-3.1.10_p20071203
new file mode 100644
index 000000000000..b6803a7fd120
--- /dev/null
+++ b/app-text/ptex/files/digest-ptex-3.1.10_p20071203
@@ -0,0 +1,15 @@
+MD5 71dfc6c1422ffb3fc2d538e2ab92fbdf ptetex-cmap-20051117.tar.gz 4061363
+RMD160 a9b4468979efc8b65161ce7deb7cd00d93dfff06 ptetex-cmap-20051117.tar.gz 4061363
+SHA256 34e50c63cba5aa1abfb1e4eece95aff9845c0f0c3115b65807670a2579a5a032 ptetex-cmap-20051117.tar.gz 4061363
+MD5 1e4fdfb20106833f0c39e8277e22da0f ptetex3-20071203.tar.gz 6210522
+RMD160 4e4719d81218eb6dfabbb5aab68b21f4a1a54cbd ptetex3-20071203.tar.gz 6210522
+SHA256 f407ef36b174e23e0a8cbd904ac159348f9cebe958b33c5dff389cc9810d4203 ptetex3-20071203.tar.gz 6210522
+MD5 f1c722c61acc20fea92d66c927eb5f99 ptex-3.1.10_p20071122-dviljk-security-fixes.patch.bz2 8739
+RMD160 7a63ebf1ebce0dbd7d48d9dbef2ea663ba187871 ptex-3.1.10_p20071122-dviljk-security-fixes.patch.bz2 8739
+SHA256 af6b92ee2640e754fc3e0b55e8aa7c8436d655f0d38e5afdd3badf5ee5f55c93 ptex-3.1.10_p20071122-dviljk-security-fixes.patch.bz2 8739
+MD5 944a4641e79e61043fdaf8f38ecbb4b3 tetex-src-3.0.tar.gz 12749314
+RMD160 15a139f5f36993e4ed3583260e175cfb13ce7bcc tetex-src-3.0.tar.gz 12749314
+SHA256 9c0f7eaeb5ba6dc6f66433404d264941bf95cded2fa798b1f7a9dd580c21649b tetex-src-3.0.tar.gz 12749314
+MD5 ed9d30d9162d16ac8d5065cde6e0f6fa tetex-texmf-3.0po.tar.gz 91402377
+RMD160 a1e87733fa3cbef04e39a690ed8549aeaaddb241 tetex-texmf-3.0po.tar.gz 91402377
+SHA256 6c3b8fa619749cbb28ca0f8847e56773d13e0bb92f1ea34287420950373640c2 tetex-texmf-3.0po.tar.gz 91402377
diff --git a/app-text/ptex/files/ptex-3.1.10_p20071203-gentoo.patch b/app-text/ptex/files/ptex-3.1.10_p20071203-gentoo.patch
new file mode 100644
index 000000000000..f478b4640a64
--- /dev/null
+++ b/app-text/ptex/files/ptex-3.1.10_p20071203-gentoo.patch
@@ -0,0 +1,96 @@
+diff -Naur ptetex3-20071203.orig/2extract-src.sh ptetex3-20071203/2extract-src.sh
+--- ptetex3-20071203.orig/2extract-src.sh	2007-11-19 15:46:22.000000000 +0900
++++ ptetex3-20071203/2extract-src.sh	2007-12-05 01:16:22.000000000 +0900
+@@ -147,29 +147,29 @@
+     $CP $SRC/texk/dvipsk/* $SRC/texk/pdvipsk/
+     $MKDIR $SRC/texk/pxdvik
+     $CP -r $SRC/texk/xdvik/* $SRC/texk/pxdvik/
+-    P=p
++    DVIPSK_P=p
+ fi # "$JAPANESE" = "international"
+ ## for dvipsk
+ #tarx archive/dvipsk-jpatch-p1.7a.tar.gz          $SRC/texk/${P}dvipsk
+-#cpatch $SRC/texk/${P}dvipsk/dvipsk-p1.7a.patch 1 $SRC/texk/${P}dvipsk
+-$CP $SRC/texk/${P}dvipsk/Makefile.in $SRC/texk/${P}dvipsk/Makefile.in.tetex
+-tarx archive/dvipsk-5.95b-p1.7a.tar.gz                $SRC/texk/${P}dvipsk
+-cpatch $SRC/texk/${P}dvipsk/dvipsk-5.95b-p1.7a.diff 1 $SRC/texk/${P}dvipsk
++#cpatch $SRC/texk/${DVIPSK_P}dvipsk/dvipsk-p1.7a.patch 1 $SRC/texk/${DVIPSK_P}dvipsk
++$CP $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in.tetex
++tarx archive/dvipsk-5.95b-p1.7a.tar.gz                $SRC/texk/${DVIPSK_P}dvipsk
++cpatch $SRC/texk/${DVIPSK_P}dvipsk/dvipsk-5.95b-p1.7a.diff 1 $SRC/texk/${DVIPSK_P}dvipsk
+ ## disable installing 'config.ps'
+-$CP $SRC/texk/${P}dvipsk/Makefile.in       $SRC/texk/${P}dvipsk/Makefile.in.jp
+-$CP $SRC/texk/${P}dvipsk/Makefile.in.tetex $SRC/texk/${P}dvipsk/Makefile.in
++$CP $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in       $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in.jp
++$CP $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in.tetex $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in
+ ## disable psfonts_jp.map
+-#perlprint 's/^(p \+psfonts\_jp\.map)/* \1/g' $SRC/texk/${P}dvipsk/config.ps
++#perlprint 's/^(p \+psfonts\_jp\.map)/* \1/g' $SRC/texk/${DVIPSK_P}dvipsk/config.ps
+ #perlnoprint '$a=1 if /^# psfonts_jp.map/; $a=0 if /^# Info files/;
+-#	print unless $a' $SRC/texk/${P}dvipsk/Makefile.in
++#	print unless $a' $SRC/texk/${DVIPSK_P}dvipsk/Makefile.in
+ 
+ ## for xdvik
+-zpatch archive/xdvik-200?????-tetex-3.0.diff.gz 3 $SRC/texk/${P}xdvik
++zpatch archive/xdvik-200?????-tetex-3.0.diff.gz 3 $SRC/texk/${DVIPSK_P}xdvik
+ # fix for FC5
+ perlprint 'print "#define NeedWidePrototypes 1\n" if /limits/' \
+-    $SRC/texk/${P}xdvik/xdvi.h
++    $SRC/texk/${DVIPSK_P}xdvik/xdvi.h
+ # adjust X resource
+-cat <<EOF >> $SRC/texk/${P}xdvik/texmf/XDvi || exit 1
++cat <<EOF >> $SRC/texk/${DVIPSK_P}xdvik/texmf/XDvi || exit 1
+ 
+ 
+ !!! ------- added by ptetex3 -------
+diff -Naur ptetex3-20071203.orig/7font-search.sh ptetex3-20071203/7font-search.sh
+--- ptetex3-20071203.orig/7font-search.sh	2007-12-03 00:43:41.000000000 +0900
++++ ptetex3-20071203/7font-search.sh	2007-12-05 01:18:50.000000000 +0900
+@@ -51,6 +51,17 @@
+     done
+ }
+ 
++mksymlink_gentoo(){
++    $MKDIR $TRUETYPE
++    fonts_dir=/usr/share/fonts/
++    find $fonts_dir -maxdepth 1 -mindepth 1 -type d | while read font_path; do
++	if [ `find $font_path -maxdepth 1 -type f -iname '*.ttf' | wc -l` -gt 0 ]; then
++	    font_name=${font_path/$fonts_dir/}
++	    test -h ${TRUETYPE}/${font_name} && continue
++	    $LN "${font_path}" "${TRUETYPE}/${font_name}"
++	fi
++    done
++}
+ 
+ setrmlgbm() {
+     if test -n "$2"; then
+@@ -105,7 +116,8 @@
+ ### リンク名  検索ディレクトリ/ファイル
+ Acrobat4    /usr{,/local,/sfw}{,/lib}/Acrobat4/Resource/CMap
+ Acrobat5    /usr{,/local,/sfw}{,/lib}/Acrobat5/Resource/Font
+-Acrobat7    /usr{,/local,/sfw}{,/lib}{,/Adobe}/Acrobat7.0/Resource/CMap
++Acrobat7    /opt/Acrobat7/Resource/CMap
++Acrobat8    /opt/Adobe/Reader8/Resource/CMap
+ ghostscript /usr{,/local,/sfw}/{share,lib}/ghostscript{,/*}/Resource/CMap
+ openwinja   /usr/openwin/lib/locale/ja/X11/Resource/CMap
+ openwinko   /usr/openwin/lib/locale/ko/X11/Resource/CMap
+@@ -113,18 +125,7 @@
+ openwintw   /usr/openwin/lib/locale/zh_TW.BIG5/X11/Resource/CMap
+ EOF
+ 
+-mksymlink $TRUETYPE <<EOF
+-### リンク名  検索ディレクトリ/ファイル
+-x11       /usr{,/local,/X11R6}/lib/X11/fonts/truetype
+-X11       /usr{,/local,/X11R6}/lib/X11/fonts/TrueType
+-X11TTF    /usr{,/local,/X11R6}/lib/X11/fonts/TTF
+-openwin   /usr/openwin/lib/locale/ja/X11/fonts/TT
+-truetype  /usr/share/fonts/truetype
+-TTF	  /usr/share/fonts/TTF
+-ja        /usr/share/fonts/ja/TrueType
+-japanese  /usr/share/fonts/japanese/TrueType
+-QtPalmtop /opt/QtPalmtop/lib/X11/fonts/TrueType
+-EOF
++mksymlink_gentoo
+ 
+ mksymlink $OPENTYPE <<EOF
+ ### リンク名  検索ディレクトリ/ファイル
diff --git a/app-text/ptex/files/xpdf-3.02pl2.patch b/app-text/ptex/files/xpdf-3.02pl2.patch
new file mode 100644
index 000000000000..40eaf2013642
--- /dev/null
+++ b/app-text/ptex/files/xpdf-3.02pl2.patch
@@ -0,0 +1,609 @@
+diff -Naur tetex-src-3.0.orig/libs/xpdf/xpdf/Stream.cc tetex-src-3.0/libs/xpdf/xpdf/Stream.cc
+--- tetex-src-3.0.orig/libs/xpdf/xpdf/Stream.cc	2004-01-22 10:26:45.000000000 +0900
++++ tetex-src-3.0/libs/xpdf/xpdf/Stream.cc	2007-12-06 08:49:50.000000000 +0900
+@@ -1260,19 +1260,27 @@
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns < 1) {
++    columns = 1;
++  }
++  else if (columns > INT_MAX - 2) columns = INT_MAX - 2;
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+-  refLine = (short *)gmalloc((columns + 3) * sizeof(short));
+-  codingLine = (short *)gmalloc((columns + 2) * sizeof(short));
++  // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
++  // ---> max codingLine size = columns + 1
++  // refLine has one extra guard entry at the end
++  // ---> max refLine size = columns + 2
++  codingLine = (int *)gmallocn(columns + 1, sizeof(int));
++  refLine = (int *)gmallocn(columns + 2, sizeof(int));
+ 
+   eof = gFalse;
+   row = 0;
+   nextLine2D = encoding < 0;
+   inputBits = 0;
+-  codingLine[0] = 0;
+-  codingLine[1] = refLine[2] = columns;
+-  a0 = 1;
++  codingLine[0] = columns;
++  a0i = 0;
++  outputBits = 0;
+ 
+   buf = EOF;
+ }
+@@ -1291,9 +1299,9 @@
+   row = 0;
+   nextLine2D = encoding < 0;
+   inputBits = 0;
+-  codingLine[0] = 0;
+-  codingLine[1] = refLine[2] = columns;
+-  a0 = 1;
++  codingLine[0] = columns;
++  a0i = 0;
++  outputBits = 0;
+   buf = EOF;
+ 
+   // skip any initial zero bits and end-of-line marker, and get the 2D
+@@ -1310,159 +1318,229 @@
+   }
+ }
+ 
++inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
++  if (a1 > codingLine[a0i]) {
++    if (a1 > columns) {
++      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
++      err = gTrue;
++      a1 = columns;
++    }
++    if ((a0i & 1) ^ blackPixels) {
++      ++a0i;
++    }
++    codingLine[a0i] = a1;
++  }
++}
++
++inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
++  if (a1 > codingLine[a0i]) {
++    if (a1 > columns) {
++      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
++      err = gTrue;
++      a1 = columns;
++    }
++    if ((a0i & 1) ^ blackPixels) {
++      ++a0i;
++    }
++    codingLine[a0i] = a1;
++  } else if (a1 < codingLine[a0i]) {
++    if (a1 < 0) {
++      error(getPos(), "Invalid CCITTFax code");
++      err = gTrue;
++      a1 = 0;
++    }
++    while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
++      --a0i;
++    }
++    codingLine[a0i] = a1;
++  }
++}
++ 
+ int CCITTFaxStream::lookChar() {
+   short code1, code2, code3;
+-  int a0New;
+-  GBool err, gotEOL;
+-  int ret;
+-  int bits, i;
+-
+-  // if at eof just return EOF
+-  if (eof && codingLine[a0] >= columns) {
+-    return EOF;
++  int b1i, blackPixels, i, bits;
++  GBool gotEOL;
++  
++  if (buf != EOF) {
++    return buf;
+   }
+ 
+   // read the next row
+-  err = gFalse;
+-  if (codingLine[a0] >= columns) {
++  if (outputBits == 0) {
+ 
++    // if at eof just return EOF
++    if (eof) {
++      return EOF;
++    }
++
++    err = gFalse;
++  
+     // 2-D encoding
+     if (nextLine2D) {
+       for (i = 0; codingLine[i] < columns; ++i)
+ 	refLine[i] = codingLine[i];
+-      refLine[i] = refLine[i + 1] = columns;
+-      b1 = 1;
+-      a0New = codingLine[a0 = 0] = 0;
+-      do {
+-	code1 = getTwoDimCode();
++      refLine[i++] = columns;
++      refLine[i] = columns;
++      codingLine[0] = 0;
++      a0i = 0;
++      b1i = 0;
++      blackPixels = 0;
++      // invariant:
++      // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
++      //                                                             <= columns
++      // exception at left edge:
++      //   codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
++      // exception at right edge:
++      //   refLine[b1i] = refLine[b1i+1] = columns is possible
++      while (codingLine[a0i] < columns) {
++  	code1 = getTwoDimCode();
+ 	switch (code1) {
+ 	case twoDimPass:
+-	  if (refLine[b1] < columns) {
+-	    a0New = refLine[b1 + 1];
+-	    b1 += 2;
++	  addPixels(refLine[b1i + 1], blackPixels);
++	  if (refLine[b1i + 1] < columns) {
++	    b1i += 2;
+ 	  }
+ 	  break;
+ 	case twoDimHoriz:
+-	  if ((a0 & 1) == 0) {
+-	    code1 = code2 = 0;
++	  code1 = code2 = 0;
++	  if (blackPixels) {
+ 	    do {
+-	      code1 += code3 = getWhiteCode();
++	      code1 += code3 = getBlackCode();
+ 	    } while (code3 >= 64);
+ 	    do {
+-	      code2 += code3 = getBlackCode();
++	      code2 += code3 = getWhiteCode();
+ 	    } while (code3 >= 64);
+ 	  } else {
+-	    code1 = code2 = 0;
+ 	    do {
+-	      code1 += code3 = getBlackCode();
++	      code1 += code3 = getWhiteCode();
+ 	    } while (code3 >= 64);
+ 	    do {
+-	      code2 += code3 = getWhiteCode();
++	      code2 += code3 = getBlackCode();
+ 	    } while (code3 >= 64);
+ 	  }
+-	  if (code1 > 0 || code2 > 0) {
+-	    codingLine[a0 + 1] = a0New + code1;
+-	    ++a0;
+-	    a0New = codingLine[a0 + 1] = codingLine[a0] + code2;
+-	    ++a0;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
++	  addPixels(codingLine[a0i] + code1, blackPixels);
++	  if (codingLine[a0i] < columns) {
++	    addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
+ 	  }
+-	  break;
+-	case twoDimVert0:
+-	  a0New = codingLine[++a0] = refLine[b1];
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
++	  while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	    b1i += 2;
+ 	  }
+ 	  break;
+-	case twoDimVertR1:
+-	  a0New = codingLine[++a0] = refLine[b1] + 1;
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
++	case twoDimVertR3:
++	  addPixels(refLine[b1i] + 3, blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    ++b1i;
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++	    }
+ 	  }
+ 	  break;
+-	case twoDimVertL1:
+-	  a0New = codingLine[++a0] = refLine[b1] - 1;
+-	  --b1;
+-	  while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	    b1 += 2;
+-	  break;
+ 	case twoDimVertR2:
+-	  a0New = codingLine[++a0] = refLine[b1] + 2;
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
++	  addPixels(refLine[b1i] + 2, blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    ++b1i;
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++	    }
+ 	  }
+ 	  break;
+-	case twoDimVertL2:
+-	  a0New = codingLine[++a0] = refLine[b1] - 2;
+-	  --b1;
+-	  while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	    b1 += 2;
++	case twoDimVertR1:
++	  addPixels(refLine[b1i] + 1, blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    ++b1i;
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++	    }
++	  }
+ 	  break;
+-	case twoDimVertR3:
+-	  a0New = codingLine[++a0] = refLine[b1] + 3;
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
++	case twoDimVert0:
++	  addPixels(refLine[b1i], blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    ++b1i;
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++	    }
+ 	  }
+ 	  break;
+ 	case twoDimVertL3:
+-	  a0New = codingLine[++a0] = refLine[b1] - 3;
+-	  --b1;
+-	  while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	    b1 += 2;
+-	  break;
+-	case EOF:
+-	  eof = gTrue;
+-	  codingLine[a0 = 0] = columns;
+-	  return EOF;
+-	default:
+-	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
+-	  err = gTrue;
++	  addPixelsNeg(refLine[b1i] - 3, blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    if (b1i > 0) {
++	      --b1i;
++	    } else {
++           ++b1i;
++	    }
++         while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++ 	    }
++ 	  }
++ 	  break;
++ 	case twoDimVertL2:
++	  addPixelsNeg(refLine[b1i] - 2, blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    if (b1i > 0) {
++	      --b1i;
++	    } else {
++	      ++b1i;
++ 	    }
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++	    }
++ 	  }
++ 	  break;
++	case twoDimVertL1:
++	  addPixelsNeg(refLine[b1i] - 1, blackPixels);
++	  blackPixels ^= 1;
++	  if (codingLine[a0i] < columns) {
++	    if (b1i > 0) {
++	      --b1i;
++	    } else {
++	      ++b1i;
++	    }
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++	      b1i += 2;
++ 	    }
++ 	  }
++ 	  break;
++ 	case EOF:
++	  addPixels(columns, 0);
++ 	  eof = gTrue;
+ 	  break;
+-	}
+-      } while (codingLine[a0] < columns);
++ 	default:
++ 	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
++	  addPixels(columns, 0);
++ 	  err = gTrue;
++ 	  break;
++ 	}
++      }
+ 
+     // 1-D encoding
+     } else {
+-      codingLine[a0 = 0] = 0;
+-      while (1) {
+-	code1 = 0;
+-	do {
+-	  code1 += code3 = getWhiteCode();
+-	} while (code3 >= 64);
+-	codingLine[a0+1] = codingLine[a0] + code1;
+-	++a0;
+-	if (codingLine[a0] >= columns)
+-	  break;
+-	code2 = 0;
+-	do {
+-	  code2 += code3 = getBlackCode();
+-	} while (code3 >= 64);
+-	codingLine[a0+1] = codingLine[a0] + code2;
+-	++a0;
+-	if (codingLine[a0] >= columns)
+-	  break;
++      codingLine[0] = 0;
++      a0i = 0;
++      blackPixels = 0;
++      while (codingLine[a0i] < columns) {
++ 	code1 = 0;
++ 	if (blackPixels) {
++ 	  do {
++ 	    code1 += code3 = getBlackCode();
++ 	  } while (code3 >= 64);
++ 	} else {
++ 	  do {
++ 	    code1 += code3 = getWhiteCode();
++ 	  } while (code3 >= 64);
++  	}
++ 	addPixels(codingLine[a0i] + code1, blackPixels);
++ 	blackPixels ^= 1;
+       }
+     }
+ 
+-    if (codingLine[a0] != columns) {
+-      error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
+-      // force the row to be the correct length
+-      while (codingLine[a0] > columns) {
+-	--a0;
+-      }
+-      codingLine[++a0] = columns;
+-      err = gTrue;
+-    }
+-
+     // byte-align the row
+     if (byteAlign) {
+       inputBits &= ~7;
+@@ -1521,14 +1599,17 @@
+     // this if we know the stream contains end-of-line markers because
+     // the "just plow on" technique tends to work better otherwise
+     } else if (err && endOfLine) {
+-      do {
++      while (1) {
++	code1 = lookBits(13);
+ 	if (code1 == EOF) {
+ 	  eof = gTrue;
+ 	  return EOF;
+ 	}
++	if ((code1 >> 1) == 0x001) {
++	  break;
++	}
+ 	eatBits(1);
+-	code1 = lookBits(13);
+-      } while ((code1 >> 1) != 0x001);
++      }
+       eatBits(12); 
+       if (encoding > 0) {
+ 	eatBits(1);
+@@ -1536,11 +1617,11 @@
+       }
+     }
+ 
+-    a0 = 0;
+-    outputBits = codingLine[1] - codingLine[0];
+-    if (outputBits == 0) {
+-      a0 = 1;
+-      outputBits = codingLine[2] - codingLine[1];
++    // set up for output
++    if (codingLine[0] > 0) {
++      outputBits = codingLine[a0i = 0];
++    } else {
++      outputBits = codingLine[a0i = 1];
+     }
+ 
+     ++row;
+@@ -1548,39 +1629,43 @@
+ 
+   // get a byte
+   if (outputBits >= 8) {
+-    ret = ((a0 & 1) == 0) ? 0xff : 0x00;
+-    if ((outputBits -= 8) == 0) {
+-      ++a0;
+-      if (codingLine[a0] < columns) {
+-	outputBits = codingLine[a0 + 1] - codingLine[a0];
+-      }
++    buf = (a0i & 1) ? 0x00 : 0xff;
++    outputBits -= 8;
++    if (outputBits == 0 && codingLine[a0i] < columns) {
++      ++a0i;
++      outputBits = codingLine[a0i] - codingLine[a0i - 1];
+     }
+   } else {
+     bits = 8;
+-    ret = 0;
++    buf = 0;
+     do {
+       if (outputBits > bits) {
+-	i = bits;
+-	bits = 0;
+-	if ((a0 & 1) == 0) {
+-	  ret |= 0xff >> (8 - i);
++	buf <<= bits;
++	if (!(a0i & 1)) {
++	  buf |= 0xff >> (8 - bits);
+ 	}
+-	outputBits -= i;
++	outputBits -= bits;
++	bits = 0;
+       } else {
+-	i = outputBits;
+-	bits -= outputBits;
+-	if ((a0 & 1) == 0) {
+-	  ret |= (0xff >> (8 - i)) << bits;
++	buf <<= outputBits;
++	if (!(a0i & 1)) {
++	  buf |= 0xff >> (8 - outputBits);
+ 	}
++	bits -= outputBits;
+ 	outputBits = 0;
+-	++a0;
+-	if (codingLine[a0] < columns) {
+-	  outputBits = codingLine[a0 + 1] - codingLine[a0];
++	if (codingLine[a0i] < columns) {
++	  ++a0i;
++	  outputBits = codingLine[a0i] - codingLine[a0i - 1];
++	} else if (bits > 0) {
++	  buf <<= bits;
++	  bits = 0;
+ 	}
+       }
+-    } while (bits > 0 && codingLine[a0] < columns);
++    } while (bits);
++  }
++  if (black) {
++    buf ^= 0xff;
+   }
+-  buf = black ? (ret ^ 0xff) : ret;
+   return buf;
+ }
+ 
+@@ -1622,6 +1707,9 @@
+   code = 0; // make gcc happy
+   if (endOfBlock) {
+     code = lookBits(12);
++    if (code == EOF) {
++      return 1;
++    }
+     if ((code >> 5) == 0) {
+       p = &whiteTab1[code];
+     } else {
+@@ -1634,6 +1722,9 @@
+   } else {
+     for (n = 1; n <= 9; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 9) {
+ 	code <<= 9 - n;
+       }
+@@ -1645,6 +1736,9 @@
+     }
+     for (n = 11; n <= 12; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 12) {
+ 	code <<= 12 - n;
+       }
+@@ -1670,6 +1764,9 @@
+   code = 0; // make gcc happy
+   if (endOfBlock) {
+     code = lookBits(13);
++    if (code == EOF) {
++      return 1;
++    }
+     if ((code >> 7) == 0) {
+       p = &blackTab1[code];
+     } else if ((code >> 9) == 0) {
+@@ -1684,6 +1781,9 @@
+   } else {
+     for (n = 2; n <= 6; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 6) {
+ 	code <<= 6 - n;
+       }
+@@ -1695,6 +1795,9 @@
+     }
+     for (n = 7; n <= 12; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 12) {
+ 	code <<= 12 - n;
+       }
+@@ -1708,6 +1811,9 @@
+     }
+     for (n = 10; n <= 13; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 13) {
+ 	code <<= 13 - n;
+       }
+@@ -1934,6 +2040,12 @@
+     // allocate a buffer for the whole image
+     bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
+     bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
++    if (bufWidth <= 0 || bufHeight <= 0 ||
++	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
++      error(getPos(), "Invalid image size in DCT stream");
++      y = height;
++      return;
++    }
+     for (i = 0; i < numComps; ++i) {
+       frameBuf[i] = (int *)gmalloc(bufWidth * bufHeight * sizeof(int));
+       memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
+@@ -2979,6 +3091,11 @@
+   }
+   scanInfo.firstCoeff = str->getChar();
+   scanInfo.lastCoeff = str->getChar();
++  if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
++      scanInfo.firstCoeff > scanInfo.lastCoeff) {
++    error(getPos(), "Bad DCT coefficient numbers in scan info block");
++    return gFalse;
++  }
+   c = str->getChar();
+   scanInfo.ah = (c >> 4) & 0x0f;
+   scanInfo.al = c & 0x0f;
+diff -Naur tetex-src-3.0.orig/libs/xpdf/xpdf/Stream.h tetex-src-3.0/libs/xpdf/xpdf/Stream.h
+--- tetex-src-3.0.orig/libs/xpdf/xpdf/Stream.h	2004-01-22 10:26:45.000000000 +0900
++++ tetex-src-3.0/libs/xpdf/xpdf/Stream.h	2007-12-05 23:55:19.000000000 +0900
+@@ -520,13 +520,15 @@
+   int row;			// current row
+   int inputBuf;			// input buffer
+   int inputBits;		// number of bits in input buffer
+-  short *refLine;		// reference line changing elements
+-  int b1;			// index into refLine
+-  short *codingLine;		// coding line changing elements
+-  int a0;			// index into codingLine
++  int *codingLine;		// coding line changing elements
++  int *refLine;			// reference line changing elements
++  int a0i;			// index into codingLine
++  GBool err;			// error on current line
+   int outputBits;		// remaining ouput bits
+   int buf;			// character buffer
+ 
++  void addPixels(int a1, int black);
++  void addPixelsNeg(int a1, int black);
+   short getTwoDimCode();
+   short getWhiteCode();
+   short getBlackCode();