Patch applied according to #115851.

(Portage version: 2.0.53)

18 files changed, 881 insertions, 103 deletions

diff --git a/kde-base/kdegraphics/ChangeLog b/kde-base/kdegraphics/ChangeLog
index 19a5d5971ae5..8f118c60cc41 100644
--- a/kde-base/kdegraphics/ChangeLog
+++ b/kde-base/kdegraphics/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for kde-base/kdegraphics
 # Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/ChangeLog,v 1.212 2005/12/17 20:41:33 corsair Exp $
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/ChangeLog,v 1.213 2005/12/20 17:45:21 carlo Exp $
+
+*kdegraphics-3.5.0-r4 (20 Dec 2005)
+*kdegraphics-3.4.3-r3 (20 Dec 2005)
+
+  20 Dec 2005; Carsten Lohrke <carlo@gentoo.org>
+  files/post-3.4.3-kdegraphics-CAN-2005-3193.diff,
+  +files/kpdf-3.5.0-cropbox-fix.patch,
+  files/post-3.5.0-kdegraphics-CAN-2005-3193.diff,
+  +kdegraphics-3.4.3-r3.ebuild, +kdegraphics-3.5.0-r4.ebuild:
+  Patch applied according to #115851.
 
   17 Dec 2005; Markus Rothe <corsair@gentoo.org>
   kdegraphics-3.5.0-r3.ebuild:
diff --git a/kde-base/kdegraphics/Manifest b/kde-base/kdegraphics/Manifest
index 42e47d0f67cf..a9d5c579c152 100644
--- a/kde-base/kdegraphics/Manifest
+++ b/kde-base/kdegraphics/Manifest
@@ -1,33 +1,38 @@
-MD5 5627d28e9933d004259103c8feec5609 kdegraphics-3.4.3.ebuild 1738
-MD5 61cf5771b25a9724b41b13d5fba9ecb9 kdegraphics-3.4.3-r2.ebuild 1796
-MD5 22bde52339486d1c48148f3ba0369d26 ChangeLog 30041
-MD5 71a6e1d836d6cce0d6a9ce6a71863200 kdegraphics-3.5.0.ebuild 1870
-MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156
-MD5 8752f936f226c4117006b64736b21b05 kdegraphics-3.3.2-r3.ebuild 1612
-MD5 511facb4e5557ab04a88092e393860db kdegraphics-3.4.1-r1.ebuild 1456
-MD5 0e1a74ea3a94e170371e7d5dbe12106e kdegraphics-3.5.0-r2.ebuild 1978
-MD5 f8b2b24be0e28925e87267accd66968a kdegraphics-3.4.2-r2.ebuild 2089
-MD5 ea77c224d553595991b0545b9c9eb29d kdegraphics-3.4.1-r3.ebuild 1525
-MD5 20b7a6b420063aaaba18a046cb798700 kdegraphics-3.5.0-r3.ebuild 2122
+MD5 f2239bc910d7134f45fac5951dcec91e ChangeLog 30405
 MD5 284f518172a2843428d308d2d48bbbee files/CAN-2005-0064.patch 793
+MD5 9eb12845ce85cc31e216d463877cb519 files/digest-kdegraphics-3.3.2-r3 71
+MD5 1a6dde4414b4ad894e4ed7ed3fa919ff files/digest-kdegraphics-3.4.1-r1 71
+MD5 1a6dde4414b4ad894e4ed7ed3fa919ff files/digest-kdegraphics-3.4.1-r3 71
+MD5 a603b1f40c870db682665f57f908df0e files/digest-kdegraphics-3.4.2-r2 71
 MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kdegraphics-3.4.3 71
 MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kdegraphics-3.4.3-r2 71
-MD5 0459ac16349d79da6246392e2454796b files/digest-kdegraphics-3.5.0-r2 71
+MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kdegraphics-3.4.3-r3 71
 MD5 0459ac16349d79da6246392e2454796b files/digest-kdegraphics-3.5.0 71
-MD5 0abb98c262645006a4b116c0635edb49 files/kdegraphics-3.4.1-gocr.patch 454
-MD5 a2e4c4878c6637efbbbb4ffd20ae6cc2 files/post-3.4.3-kdegraphics-CAN-2005-3193.diff 6383
-MD5 bf6b28780e0f5ea8f99e0777187e73cb files/post-3.3.2-kdegraphics.diff 1385
+MD5 0459ac16349d79da6246392e2454796b files/digest-kdegraphics-3.5.0-r2 71
+MD5 0459ac16349d79da6246392e2454796b files/digest-kdegraphics-3.5.0-r3 71
+MD5 0459ac16349d79da6246392e2454796b files/digest-kdegraphics-3.5.0-r4 71
 MD5 72b0e0cd29559b5ac4a20829a3da892c files/kdegraphics-3.4-configure.patch 847
-MD5 9eb12845ce85cc31e216d463877cb519 files/digest-kdegraphics-3.3.2-r3 71
-MD5 1a6dde4414b4ad894e4ed7ed3fa919ff files/digest-kdegraphics-3.4.1-r1 71
-MD5 d18efc8eb0bf3e3b54a33cf04cdba3fd files/kpdf-3.5.0-splitter-io.patch 1415
 MD5 c52515e268cbff75a6f7b7d1ee1fad47 files/kdegraphics-3.4-gcc4.patch 1226
+MD5 0abb98c262645006a4b116c0635edb49 files/kdegraphics-3.4.1-gocr.patch 454
+MD5 653bd55a1e87c51731d0b0512051774e files/kdegraphics-3.4.2-kpdf-contentcrash.patch 749
 MD5 4caddebea4d845abb2de6dbbfe1b979a files/kdegraphics-3.4.2-kpdf-fix.patch 1024
+MD5 8db8a9b442f66e9567ad591c8f03530e files/kdegraphics-3.5.0-kpovmodeler.patch 446
+MD5 cba50683fe0c9704ddfcd91fde5129c8 files/kpdf-3.5.0-cropbox-fix.patch 631
+MD5 d18efc8eb0bf3e3b54a33cf04cdba3fd files/kpdf-3.5.0-splitter-io.patch 1415
 MD5 4a4bcdcb2456ab92b7846b6646da1bcb files/post-3.3.1-kdegraphics-4.diff 1797
+MD5 bf6b28780e0f5ea8f99e0777187e73cb files/post-3.3.2-kdegraphics.diff 1385
 MD5 ec3b95efe9139f4259d6de213fe4b87b files/post-3.4.1-kdegraphics-4.diff 1827
-MD5 a603b1f40c870db682665f57f908df0e files/digest-kdegraphics-3.4.2-r2 71
-MD5 653bd55a1e87c51731d0b0512051774e files/kdegraphics-3.4.2-kpdf-contentcrash.patch 749
-MD5 1a6dde4414b4ad894e4ed7ed3fa919ff files/digest-kdegraphics-3.4.1-r3 71
-MD5 0459ac16349d79da6246392e2454796b files/digest-kdegraphics-3.5.0-r3 71
-MD5 8db8a9b442f66e9567ad591c8f03530e files/kdegraphics-3.5.0-kpovmodeler.patch 446
-MD5 45bc3c00d76feb234aa5db42da0137e5 files/post-3.5.0-kdegraphics-CAN-2005-3193.diff 4768
+MD5 e8dde74416769d4589dcca25072aea3e files/post-3.4.3-kdegraphics-CAN-2005-3193.diff 9685
+MD5 17ea076e986be5e26a4feea3cd264f7e files/post-3.5.0-kdegraphics-CAN-2005-3193.diff 8611
+MD5 8752f936f226c4117006b64736b21b05 kdegraphics-3.3.2-r3.ebuild 1612
+MD5 511facb4e5557ab04a88092e393860db kdegraphics-3.4.1-r1.ebuild 1456
+MD5 ea77c224d553595991b0545b9c9eb29d kdegraphics-3.4.1-r3.ebuild 1525
+MD5 f8b2b24be0e28925e87267accd66968a kdegraphics-3.4.2-r2.ebuild 2089
+MD5 61cf5771b25a9724b41b13d5fba9ecb9 kdegraphics-3.4.3-r2.ebuild 1796
+MD5 d9e8008c4edf734745d91c47288ae026 kdegraphics-3.4.3-r3.ebuild 1692
+MD5 5627d28e9933d004259103c8feec5609 kdegraphics-3.4.3.ebuild 1738
+MD5 0e1a74ea3a94e170371e7d5dbe12106e kdegraphics-3.5.0-r2.ebuild 1978
+MD5 20b7a6b420063aaaba18a046cb798700 kdegraphics-3.5.0-r3.ebuild 2122
+MD5 b76c9f9ca02e644b629e351ba7249028 kdegraphics-3.5.0-r4.ebuild 2075
+MD5 71a6e1d836d6cce0d6a9ce6a71863200 kdegraphics-3.5.0.ebuild 1870
+MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156
diff --git a/kde-base/kdegraphics/files/digest-kdegraphics-3.4.3-r3 b/kde-base/kdegraphics/files/digest-kdegraphics-3.4.3-r3
new file mode 100644
index 000000000000..2cb888ba9f29
--- /dev/null
+++ b/kde-base/kdegraphics/files/digest-kdegraphics-3.4.3-r3
@@ -0,0 +1 @@
+MD5 e2b2926301204a0f587d9e6e163c06d9 kdegraphics-3.4.3.tar.bz2 6554272
diff --git a/kde-base/kdegraphics/files/digest-kdegraphics-3.5.0-r4 b/kde-base/kdegraphics/files/digest-kdegraphics-3.5.0-r4
new file mode 100644
index 000000000000..44e671a5ef99
--- /dev/null
+++ b/kde-base/kdegraphics/files/digest-kdegraphics-3.5.0-r4
@@ -0,0 +1 @@
+MD5 389a00d4387e621d4dd325a59c7657c4 kdegraphics-3.5.0.tar.bz2 7094349
diff --git a/kde-base/kdegraphics/files/kpdf-3.5.0-cropbox-fix.patch b/kde-base/kdegraphics/files/kpdf-3.5.0-cropbox-fix.patch
new file mode 100644
index 000000000000..17fbeeaee27c
--- /dev/null
+++ b/kde-base/kdegraphics/files/kpdf-3.5.0-cropbox-fix.patch
@@ -0,0 +1,23 @@
+--- branches/KDE/3.5/kdegraphics/kpdf/xpdf/xpdf/Page.cc	2005/09/09 18:24:18	459064
++++ branches/KDE/3.5/kdegraphics/kpdf/xpdf/xpdf/Page.cc	2005/12/18 21:44:35	489480
+@@ -66,6 +66,20 @@
+   if (!haveCropBox) {
+     cropBox = mediaBox;
+   }
++  else
++  {
++    // cropBox can not be bigger than mediaBox
++    if (cropBox.x2 - cropBox.x1 > mediaBox.x2 - mediaBox.x1)
++    {
++      cropBox.x1 = mediaBox.x1;
++      cropBox.x2 = mediaBox.x2;
++    }
++    if (cropBox.y2 - cropBox.y1 > mediaBox.y2 - mediaBox.y1)
++    {
++      cropBox.y1 = mediaBox.y1;
++      cropBox.y2 = mediaBox.y2;
++    }
++  }
+ 
+   // other boxes
+   bleedBox = cropBox;
diff --git a/kde-base/kdegraphics/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff b/kde-base/kdegraphics/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff
index c060c4e31324..8c1d3ac42603 100644
--- a/kde-base/kdegraphics/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff
+++ b/kde-base/kdegraphics/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff
@@ -1,7 +1,87 @@
+Index: kpdf/xpdf/xpdf/JBIG2Stream.cc
+===================================================================
+--- kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 466932)
++++ kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 488714)
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,6 +682,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+ }
+ 
+@@ -690,6 +698,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+   memcpy(data, bitmap->data, h * line);
+ }
+@@ -716,7 +731,10 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++  if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    gfree(data);
++    data = NULL;
+     return;
+   }
+   data = (Guchar *)grealloc(data, newH * line);
+@@ -2256,6 +2274,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -2887,6 +2914,11 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
+   JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
++    error(-1, "invalid width/height");
++    return NULL;
++  }
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
 Index: kpdf/xpdf/xpdf/Stream.cc
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.cc	(revision 486337)
-+++ kpdf/xpdf/xpdf/Stream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.cc	(revision 466932)
++++ kpdf/xpdf/xpdf/Stream.cc	(revision 488714)
 @@ -15,6 +15,7 @@
  #include <stdio.h>
  #include <stdlib.h>
@@ -23,7 +103,7 @@ Index: kpdf/xpdf/xpdf/Stream.cc
 +    return;
  
    nVals = width * nComps;
-+  if (nVals + 7 <= 0)
++  if (nVals * nBits + 7 <= 0)
 +    return;
    pixBytes = (nComps * nBits + 7) >> 3;
    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
@@ -49,40 +129,81 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    } else {
      pred = NULL;
    }
-@@ -2899,6 +2918,10 @@ GBool DCTStream::readBaselineSOF() {
+@@ -1261,6 +1280,10 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++    error(-1, "invalid number of columns");
++    exit(1);
++  }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+@@ -2899,6 +2922,11 @@ GBool DCTStream::readBaselineSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2925,6 +2948,10 @@ GBool DCTStream::readProgressiveSOF() {
+@@ -2925,6 +2953,11 @@ GBool DCTStream::readProgressiveSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2947,6 +2974,10 @@ GBool DCTStream::readScanInfo() {
+@@ -2947,6 +2980,11 @@ GBool DCTStream::readScanInfo() {
  
    length = read16() - 2;
    scanInfo.numComps = str->getChar();
 +  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    scanInfo.numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    --length;
    if (length != 2 * scanInfo.numComps + 3) {
      error(getPos(), "Bad DCT scan info block");
-@@ -3258,6 +3289,10 @@ FlateStream::FlateStream(Stream *strA, i
+@@ -3021,12 +3059,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3144,9 +3182,11 @@ int DCTStream::readMarker() {
+   do {
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c != 0xff);
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c == 0xff);
+   } while (c == 0x00);
+   return c;
+@@ -3258,6 +3298,10 @@ FlateStream::FlateStream(Stream *strA, i
      FilterStream(strA) {
    if (predictor != 1) {
      pred = new StreamPredictor(this, predictor, columns, colors, bits);
@@ -95,8 +216,8 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    }
 Index: kpdf/xpdf/xpdf/Stream.h
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.h	(revision 486337)
-+++ kpdf/xpdf/xpdf/Stream.h	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.h	(revision 466932)
++++ kpdf/xpdf/xpdf/Stream.h	(revision 488714)
 @@ -233,6 +233,8 @@ public:
  
    ~StreamPredictor();
@@ -116,8 +237,8 @@ Index: kpdf/xpdf/xpdf/Stream.h
  //------------------------------------------------------------------------
 Index: kpdf/xpdf/xpdf/JPXStream.cc
 ===================================================================
---- kpdf/xpdf/xpdf/JPXStream.cc	(revision 486337)
-+++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/JPXStream.cc	(revision 466932)
++++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 488714)
 @@ -7,6 +7,7 @@
  //========================================================================
  
@@ -152,8 +273,8 @@ Index: kpdf/xpdf/xpdf/JPXStream.cc
  							sizeof(JPXTileComp));
 Index: kpdf/xpdf/goo/gmem.c
 ===================================================================
---- kpdf/xpdf/goo/gmem.c	(revision 486337)
-+++ kpdf/xpdf/goo/gmem.c	(revision 487206)
+--- kpdf/xpdf/goo/gmem.c	(revision 466932)
++++ kpdf/xpdf/goo/gmem.c	(revision 488714)
 @@ -11,6 +11,7 @@
  #include <stdlib.h>
  #include <stddef.h>
@@ -193,8 +314,8 @@ Index: kpdf/xpdf/goo/gmem.c
    GMemHdr *p;
 Index: kpdf/xpdf/goo/gmem.h
 ===================================================================
---- kpdf/xpdf/goo/gmem.h	(revision 486337)
-+++ kpdf/xpdf/goo/gmem.h	(revision 487206)
+--- kpdf/xpdf/goo/gmem.h	(revision 466932)
++++ kpdf/xpdf/goo/gmem.h	(revision 488714)
 @@ -28,6 +28,15 @@ extern void *gmalloc(size_t size);
  extern void *grealloc(void *p, size_t size);
  
diff --git a/kde-base/kdegraphics/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff b/kde-base/kdegraphics/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff
index a30fe74a789a..0b6f22303de8 100644
--- a/kde-base/kdegraphics/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff
+++ b/kde-base/kdegraphics/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff
@@ -1,7 +1,81 @@
+Index: kpdf/xpdf/xpdf/JBIG2Stream.cc
+===================================================================
+--- kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 481099)
++++ kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 488715)
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,6 +682,12 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line ) {
++    data = NULL;
++    return;
++  }
++  
+   // need to allocate one extra guard byte for use in combine()
+   data = (Guchar *)gmalloc(h * line + 1);
+   data[h * line] = 0;
+@@ -692,6 +699,12 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
++    data = NULL;
++    return;
++  }
++ 
+   // need to allocate one extra guard byte for use in combine()
+   data = (Guchar *)gmalloc(h * line + 1);
+   memcpy(data, bitmap->data, h * line);
+@@ -720,7 +733,8 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++
++  if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) {
+     return;
+   }
+   // need to allocate one extra guard byte for use in combine()
+@@ -2305,6 +2319,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (h < 0 || w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -2936,6 +2959,9 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
+   JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h)
++    return NULL;
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
 Index: kpdf/xpdf/xpdf/Stream.cc
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.cc	(revision 473213)
-+++ kpdf/xpdf/xpdf/Stream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.cc	(revision 481099)
++++ kpdf/xpdf/xpdf/Stream.cc	(revision 488715)
 @@ -15,6 +15,7 @@
  #include <stdio.h>
  #include <stdlib.h>
@@ -23,7 +97,7 @@ Index: kpdf/xpdf/xpdf/Stream.cc
 +    return;
  
    nVals = width * nComps;
-+  if (nVals + 7 <= 0)
++  if (nVals * nBits + 7 <= 0)
 +    return;
    pixBytes = (nComps * nBits + 7) >> 3;
    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
@@ -49,12 +123,25 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    } else {
      pred = NULL;
    }
-@@ -2903,7 +2922,11 @@ GBool DCTStream::readBaselineSOF() {
+@@ -1258,8 +1277,9 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
+-  if (columns < 1) {
+-    columns = 1;
++  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++     error(getPos(), "Bad number of columns in CCITTFaxStream");
++     exit(1);
+   }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+@@ -2903,7 +2923,12 @@ GBool DCTStream::readBaselineSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 -  if (prec != 8) {
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream", prec);
 +    return gFalse;
 +  }
@@ -62,29 +149,46 @@ Index: kpdf/xpdf/xpdf/Stream.cc
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
    }
-@@ -2929,6 +2952,10 @@ GBool DCTStream::readProgressiveSOF() {
+@@ -2929,6 +2954,11 @@ GBool DCTStream::readProgressiveSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2951,6 +2978,10 @@ GBool DCTStream::readScanInfo() {
+@@ -2951,6 +2981,11 @@ GBool DCTStream::readScanInfo() {
  
    length = read16() - 2;
    scanInfo.numComps = str->getChar();
 +  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    scanInfo.numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    --length;
    if (length != 2 * scanInfo.numComps + 3) {
      error(getPos(), "Bad DCT scan info block");
-@@ -3833,6 +3864,10 @@ FlateStream::FlateStream(Stream *strA, i
+@@ -3035,12 +3070,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3833,6 +3868,10 @@ FlateStream::FlateStream(Stream *strA, i
      FilterStream(strA) {
    if (predictor != 1) {
      pred = new StreamPredictor(this, predictor, columns, colors, bits);
@@ -97,8 +201,8 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    }
 Index: kpdf/xpdf/xpdf/Stream.h
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.h	(revision 473213)
-+++ kpdf/xpdf/xpdf/Stream.h	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.h	(revision 481099)
++++ kpdf/xpdf/xpdf/Stream.h	(revision 488715)
 @@ -232,6 +232,8 @@ public:
  
    ~StreamPredictor();
@@ -116,10 +220,8 @@ Index: kpdf/xpdf/xpdf/Stream.h
  };
  
  //------------------------------------------------------------------------
-Index: kpdf/xpdf/xpdf/JPXStream.cc
-===================================================================
---- kpdf/xpdf/xpdf/JPXStream.cc	(revision 473213)
-+++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/JPXStream.cc	(revision 481099)
++++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 488715)
 @@ -7,6 +7,7 @@
  //========================================================================
  
@@ -153,3 +255,33 @@ Index: kpdf/xpdf/xpdf/JPXStream.cc
        for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
  	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
  							sizeof(JPXTileComp));
+Index: kpdf/xpdf/goo/gmem.c
+===================================================================
+--- kpdf/xpdf/goo/gmem.c	(revision 481099)
++++ kpdf/xpdf/goo/gmem.c	(revision 488715)
+@@ -11,6 +11,7 @@
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <string.h>
++#include <limits.h>
+ #include "gmem.h"
+ 
+ #ifdef DEBUG_MEM
+@@ -141,7 +142,7 @@ void *gmallocn(int nObjs, int objSize) {
+   int n;
+ 
+   n = nObjs * objSize;
+-  if (objSize == 0 || n / objSize != nObjs) {
++  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+     fprintf(stderr, "Bogus memory allocation size\n");
+     exit(1);
+   }
+@@ -152,7 +153,7 @@ void *greallocn(void *p, int nObjs, int 
+   int n;
+ 
+   n = nObjs * objSize;
+-  if (objSize == 0 || n / objSize != nObjs) {
++  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+     fprintf(stderr, "Bogus memory allocation size\n");
+     exit(1);
+   }
diff --git a/kde-base/kdegraphics/kdegraphics-3.4.3-r3.ebuild b/kde-base/kdegraphics/kdegraphics-3.4.3-r3.ebuild
new file mode 100644
index 000000000000..bf6dc1efdc20
--- /dev/null
+++ b/kde-base/kdegraphics/kdegraphics-3.4.3-r3.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/kdegraphics-3.4.3-r3.ebuild,v 1.1 2005/12/20 17:45:21 carlo Exp $
+
+inherit kde-dist eutils
+
+DESCRIPTION="KDE graphics-related apps"
+
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~mips ~ppc ~sparc ~x86"
+IUSE="gphoto2 imlib nodrm openexr opengl povray scanner tetex"
+
+DEPEND="~kde-base/kdebase-${PV}
+	>=media-libs/freetype-2
+	media-libs/fontconfig
+	gphoto2? ( media-libs/libgphoto2 )
+	scanner? ( media-gfx/sane-backends )
+	media-libs/libart_lgpl
+	media-libs/lcms
+	dev-libs/fribidi
+	imlib? ( media-libs/imlib )
+	virtual/ghostscript
+	media-libs/tiff
+	openexr? ( >=media-libs/openexr-1.2 )
+	povray? ( media-gfx/povray
+		  virtual/opengl )"
+
+RDEPEND="${DEPEND}
+	app-text/xpdf
+	tetex? (
+	|| ( >=app-text/tetex-2
+	     app-text/ptex
+	     app-text/cstetex
+	     app-text/dvipdfm ) )"
+
+DEPEND="${DEPEND}
+	dev-util/pkgconfig"
+
+src_unpack() {
+	kde_src_unpack
+
+	# Fix detection of gocr (kde bug 90082).
+	epatch "${FILESDIR}/kdegraphics-3.4.1-gocr.patch"
+
+	# Configure patch. Applied for 3.5.
+	epatch "${FILESDIR}/kdegraphics-3.4-configure.patch"
+
+	epatch "${FILESDIR}/post-3.4.3-kdegraphics-CAN-2005-3193.diff"
+
+	# For the configure patch.
+	make -f admin/Makefile.common || die
+}
+
+src_compile() {
+	if use gphoto2; then
+		myconf="${myconf} --with-kamera \
+				  --with-gphoto2-includes=/usr/include/gphoto2 \
+				  --with-gphoto2-libraries=/usr/lib/gphoto2"
+	else
+		myconf="${myconf} --without-kamera"
+	fi
+
+	use scanner || export DO_NOT_COMPILE="${DO_NOT_COMPILE} kooka libkscan"
+	use povray || export DO_NOT_COMPILE="${DO_NOT_COMPILE} kpovmodeler"
+
+	myconf="${myconf} $(use_with imlib) $(use_enable !nodrm kpdf-drm)
+		$(use_with openexr)"
+
+	kde_src_compile
+}
diff --git a/kde-base/kdegraphics/kdegraphics-3.5.0-r4.ebuild b/kde-base/kdegraphics/kdegraphics-3.5.0-r4.ebuild
new file mode 100644
index 000000000000..a31efd298b7b
--- /dev/null
+++ b/kde-base/kdegraphics/kdegraphics-3.5.0-r4.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/kdegraphics-3.5.0-r4.ebuild,v 1.1 2005/12/20 17:45:21 carlo Exp $
+
+inherit kde-dist eutils
+
+DESCRIPTION="KDE graphics-related apps"
+
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="gphoto2 imlib openexr opengl pdflib povray scanner tetex"
+
+DEPEND="~kde-base/kdebase-${PV}
+	>=media-libs/freetype-2
+	media-libs/fontconfig
+	gphoto2? ( media-libs/libgphoto2 )
+	scanner? ( media-gfx/sane-backends )
+	media-libs/libart_lgpl
+	media-libs/lcms
+	dev-libs/fribidi
+	imlib? ( media-libs/imlib )
+	virtual/ghostscript
+	media-libs/tiff
+	openexr? ( >=media-libs/openexr-1.2 )
+	povray? ( media-gfx/povray
+		  virtual/opengl )
+	pdflib? ( >=app-text/poppler-0.3.1 )"
+
+RDEPEND="${DEPEND}
+	tetex? (
+	|| ( >=app-text/tetex-2
+	     app-text/ptex
+	     app-text/cstetex
+	     app-text/dvipdfm ) )"
+
+DEPEND="${DEPEND}
+	dev-util/pkgconfig"
+
+PATCHES="${FILESDIR}/post-3.5.0-kdegraphics-CAN-2005-3193.diff
+	${FILESDIR}/kpdf-3.5.0-splitter-io.patch
+	${FILESDIR}/kpdf-3.5.0-cropbox-fix.patch
+	${FILESDIR}/kdegraphics-3.5.0-kpovmodeler.patch"
+
+pkg_setup() {
+	if ! built_with_use virtual/ghostscript X; then
+		eerror "This package requires virtual/ghostscript compiled with X11 support."
+		eerror "Please reemerge virtual/ghostscript with USE=\"X\"."
+		die "Please reemerge virtual/ghostscript with USE=\"X\"."
+	fi
+	if use pdflib && ! built_with_use app-text/poppler qt; then
+		eerror "This package requires app-text/poppler compiled with Qt support."
+		eerror "Please reemerge app-text/poppler with USE=\"qt\"."
+		die "Please reemerge app-text/poppler with USE=\"qt\"."
+	fi
+}
+
+src_compile() {
+	local myconf="$(use_with openexr) $(use_with pdflib poppler)
+	              $(use_with gphoto2 kamera)"
+
+	use imlib || export DO_NOT_COMPILE="${DO_NOT_COMPILE} kuickshow"
+	use scanner || export DO_NOT_COMPILE="${DO_NOT_COMPILE} kooka libkscan"
+	use povray || export DO_NOT_COMPILE="${DO_NOT_COMPILE} kpovmodeler"
+
+	kde_src_compile
+}
diff --git a/kde-base/kpdf/ChangeLog b/kde-base/kpdf/ChangeLog
index 226c5283ef93..178dd043aeb0 100644
--- a/kde-base/kpdf/ChangeLog
+++ b/kde-base/kpdf/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for kde-base/kpdf
 # Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/ChangeLog,v 1.56 2005/12/17 13:26:50 corsair Exp $
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/ChangeLog,v 1.57 2005/12/20 17:42:35 carlo Exp $
+
+*kpdf-3.5.0-r3 (20 Dec 2005)
+*kpdf-3.4.3-r3 (20 Dec 2005)
+
+  20 Dec 2005; Carsten Lohrke <carlo@gentoo.org>
+  files/post-3.4.3-kdegraphics-CAN-2005-3193.diff,
+  +files/kpdf-3.5.0-cropbox-fix.patch,
+  files/post-3.5.0-kdegraphics-CAN-2005-3193.diff, +kpdf-3.4.3-r3.ebuild,
+  +kpdf-3.5.0-r3.ebuild:
+  Patch applied according to #115851.
 
   17 Dec 2005; Markus Rothe <corsair@gentoo.org> kpdf-3.5.0-r2.ebuild:
   Added ~ppc64
diff --git a/kde-base/kpdf/Manifest b/kde-base/kpdf/Manifest
index 087d9c532682..afe3a4c4ccf2 100644
--- a/kde-base/kpdf/Manifest
+++ b/kde-base/kpdf/Manifest
@@ -1,28 +1,33 @@
-MD5 0fed3ae243af51328ac417aba30a1de8 ChangeLog 7446
-MD5 710200655b097652c4ea66ea6e5931db kpdf-3.4.1.ebuild 569
-MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156
-MD5 9d42c07d0672b69a347a437c76b5e024 kpdf-3.4.2.ebuild 578
-MD5 493fdf9a2dc94e56301161f38122b422 kpdf-3.4.1-r1.ebuild 627
-MD5 da8c7b95896e393c3af5901801f76253 kpdf-3.4.2-r1.ebuild 698
-MD5 26ec262357d5acdd4fbe2e83d488e692 kpdf-3.4.2-r2.ebuild 816
-MD5 fb75128e908283c51dbc40125468bb21 kpdf-3.4.3-r2.ebuild 645
-MD5 71273e2bb8b2c3a5e1407a5a32a4b68a kpdf-3.4.3.ebuild 576
-MD5 531c4b155103eed24f2f88d83d3b6461 kpdf-3.5.0-r2.ebuild 953
-MD5 8d30155d231e3dec857b28b81b157f36 kpdf-3.4.1-r3.ebuild 684
-MD5 83802275c8156d6e4aff171ef643d683 kpdf-3.5.0.ebuild 841
-MD5 1334abaee53983ad0a0810adeafef453 files/digest-kpdf-3.4.1-r1 221
+MD5 b0fade9ec1acd5d0decc7d235825e1b5 ChangeLog 7782
 MD5 1334abaee53983ad0a0810adeafef453 files/digest-kpdf-3.4.1 221
+MD5 1334abaee53983ad0a0810adeafef453 files/digest-kpdf-3.4.1-r1 221
+MD5 912bf2607fc0c67f023f6084731eba21 files/digest-kpdf-3.4.1-r3 221
 MD5 cb94e5a98246b8c80e29c3d668e4be9d files/digest-kpdf-3.4.2 300
 MD5 cb94e5a98246b8c80e29c3d668e4be9d files/digest-kpdf-3.4.2-r1 300
-MD5 4caddebea4d845abb2de6dbbfe1b979a files/kdegraphics-3.4.2-kpdf-fix.patch 1024
-MD5 ec3b95efe9139f4259d6de213fe4b87b files/post-3.4.1-kdegraphics-4.diff 1827
 MD5 cb94e5a98246b8c80e29c3d668e4be9d files/digest-kpdf-3.4.2-r2 300
-MD5 653bd55a1e87c51731d0b0512051774e files/kdegraphics-3.4.2-kpdf-contentcrash.patch 749
-MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kpdf-3.4.3-r2 71
 MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kpdf-3.4.3 71
+MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kpdf-3.4.3-r2 71
+MD5 ad9f9a5920cdd067ae76d39d768fce5f files/digest-kpdf-3.4.3-r3 71
+MD5 0459ac16349d79da6246392e2454796b files/digest-kpdf-3.5.0 71
 MD5 0459ac16349d79da6246392e2454796b files/digest-kpdf-3.5.0-r2 71
+MD5 0459ac16349d79da6246392e2454796b files/digest-kpdf-3.5.0-r3 71
+MD5 653bd55a1e87c51731d0b0512051774e files/kdegraphics-3.4.2-kpdf-contentcrash.patch 749
+MD5 4caddebea4d845abb2de6dbbfe1b979a files/kdegraphics-3.4.2-kpdf-fix.patch 1024
+MD5 cba50683fe0c9704ddfcd91fde5129c8 files/kpdf-3.5.0-cropbox-fix.patch 631
 MD5 d18efc8eb0bf3e3b54a33cf04cdba3fd files/kpdf-3.5.0-splitter-io.patch 1415
-MD5 0459ac16349d79da6246392e2454796b files/digest-kpdf-3.5.0 71
-MD5 a2e4c4878c6637efbbbb4ffd20ae6cc2 files/post-3.4.3-kdegraphics-CAN-2005-3193.diff 6383
-MD5 912bf2607fc0c67f023f6084731eba21 files/digest-kpdf-3.4.1-r3 221
-MD5 45bc3c00d76feb234aa5db42da0137e5 files/post-3.5.0-kdegraphics-CAN-2005-3193.diff 4768
+MD5 ec3b95efe9139f4259d6de213fe4b87b files/post-3.4.1-kdegraphics-4.diff 1827
+MD5 e8dde74416769d4589dcca25072aea3e files/post-3.4.3-kdegraphics-CAN-2005-3193.diff 9685
+MD5 17ea076e986be5e26a4feea3cd264f7e files/post-3.5.0-kdegraphics-CAN-2005-3193.diff 8611
+MD5 493fdf9a2dc94e56301161f38122b422 kpdf-3.4.1-r1.ebuild 627
+MD5 8d30155d231e3dec857b28b81b157f36 kpdf-3.4.1-r3.ebuild 684
+MD5 710200655b097652c4ea66ea6e5931db kpdf-3.4.1.ebuild 569
+MD5 da8c7b95896e393c3af5901801f76253 kpdf-3.4.2-r1.ebuild 698
+MD5 26ec262357d5acdd4fbe2e83d488e692 kpdf-3.4.2-r2.ebuild 816
+MD5 9d42c07d0672b69a347a437c76b5e024 kpdf-3.4.2.ebuild 578
+MD5 fb75128e908283c51dbc40125468bb21 kpdf-3.4.3-r2.ebuild 645
+MD5 95c5e1bf792e070050efc7d89627b996 kpdf-3.4.3-r3.ebuild 554
+MD5 71273e2bb8b2c3a5e1407a5a32a4b68a kpdf-3.4.3.ebuild 576
+MD5 531c4b155103eed24f2f88d83d3b6461 kpdf-3.5.0-r2.ebuild 953
+MD5 e25b5efd214847b6241c44c9fbe0104a kpdf-3.5.0-r3.ebuild 899
+MD5 83802275c8156d6e4aff171ef643d683 kpdf-3.5.0.ebuild 841
+MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156
diff --git a/kde-base/kpdf/files/digest-kpdf-3.4.3-r3 b/kde-base/kpdf/files/digest-kpdf-3.4.3-r3
new file mode 100644
index 000000000000..2cb888ba9f29
--- /dev/null
+++ b/kde-base/kpdf/files/digest-kpdf-3.4.3-r3
@@ -0,0 +1 @@
+MD5 e2b2926301204a0f587d9e6e163c06d9 kdegraphics-3.4.3.tar.bz2 6554272
diff --git a/kde-base/kpdf/files/digest-kpdf-3.5.0-r3 b/kde-base/kpdf/files/digest-kpdf-3.5.0-r3
new file mode 100644
index 000000000000..44e671a5ef99
--- /dev/null
+++ b/kde-base/kpdf/files/digest-kpdf-3.5.0-r3
@@ -0,0 +1 @@
+MD5 389a00d4387e621d4dd325a59c7657c4 kdegraphics-3.5.0.tar.bz2 7094349
diff --git a/kde-base/kpdf/files/kpdf-3.5.0-cropbox-fix.patch b/kde-base/kpdf/files/kpdf-3.5.0-cropbox-fix.patch
new file mode 100644
index 000000000000..17fbeeaee27c
--- /dev/null
+++ b/kde-base/kpdf/files/kpdf-3.5.0-cropbox-fix.patch
@@ -0,0 +1,23 @@
+--- branches/KDE/3.5/kdegraphics/kpdf/xpdf/xpdf/Page.cc	2005/09/09 18:24:18	459064
++++ branches/KDE/3.5/kdegraphics/kpdf/xpdf/xpdf/Page.cc	2005/12/18 21:44:35	489480
+@@ -66,6 +66,20 @@
+   if (!haveCropBox) {
+     cropBox = mediaBox;
+   }
++  else
++  {
++    // cropBox can not be bigger than mediaBox
++    if (cropBox.x2 - cropBox.x1 > mediaBox.x2 - mediaBox.x1)
++    {
++      cropBox.x1 = mediaBox.x1;
++      cropBox.x2 = mediaBox.x2;
++    }
++    if (cropBox.y2 - cropBox.y1 > mediaBox.y2 - mediaBox.y1)
++    {
++      cropBox.y1 = mediaBox.y1;
++      cropBox.y2 = mediaBox.y2;
++    }
++  }
+ 
+   // other boxes
+   bleedBox = cropBox;
diff --git a/kde-base/kpdf/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff b/kde-base/kpdf/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff
index c060c4e31324..8c1d3ac42603 100644
--- a/kde-base/kpdf/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff
+++ b/kde-base/kpdf/files/post-3.4.3-kdegraphics-CAN-2005-3193.diff
@@ -1,7 +1,87 @@
+Index: kpdf/xpdf/xpdf/JBIG2Stream.cc
+===================================================================
+--- kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 466932)
++++ kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 488714)
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,6 +682,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+ }
+ 
+@@ -690,6 +698,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+   memcpy(data, bitmap->data, h * line);
+ }
+@@ -716,7 +731,10 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++  if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    gfree(data);
++    data = NULL;
+     return;
+   }
+   data = (Guchar *)grealloc(data, newH * line);
+@@ -2256,6 +2274,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -2887,6 +2914,11 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
+   JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
++    error(-1, "invalid width/height");
++    return NULL;
++  }
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
 Index: kpdf/xpdf/xpdf/Stream.cc
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.cc	(revision 486337)
-+++ kpdf/xpdf/xpdf/Stream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.cc	(revision 466932)
++++ kpdf/xpdf/xpdf/Stream.cc	(revision 488714)
 @@ -15,6 +15,7 @@
  #include <stdio.h>
  #include <stdlib.h>
@@ -23,7 +103,7 @@ Index: kpdf/xpdf/xpdf/Stream.cc
 +    return;
  
    nVals = width * nComps;
-+  if (nVals + 7 <= 0)
++  if (nVals * nBits + 7 <= 0)
 +    return;
    pixBytes = (nComps * nBits + 7) >> 3;
    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
@@ -49,40 +129,81 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    } else {
      pred = NULL;
    }
-@@ -2899,6 +2918,10 @@ GBool DCTStream::readBaselineSOF() {
+@@ -1261,6 +1280,10 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++    error(-1, "invalid number of columns");
++    exit(1);
++  }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+@@ -2899,6 +2922,11 @@ GBool DCTStream::readBaselineSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2925,6 +2948,10 @@ GBool DCTStream::readProgressiveSOF() {
+@@ -2925,6 +2953,11 @@ GBool DCTStream::readProgressiveSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2947,6 +2974,10 @@ GBool DCTStream::readScanInfo() {
+@@ -2947,6 +2980,11 @@ GBool DCTStream::readScanInfo() {
  
    length = read16() - 2;
    scanInfo.numComps = str->getChar();
 +  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    scanInfo.numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    --length;
    if (length != 2 * scanInfo.numComps + 3) {
      error(getPos(), "Bad DCT scan info block");
-@@ -3258,6 +3289,10 @@ FlateStream::FlateStream(Stream *strA, i
+@@ -3021,12 +3059,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3144,9 +3182,11 @@ int DCTStream::readMarker() {
+   do {
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c != 0xff);
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c == 0xff);
+   } while (c == 0x00);
+   return c;
+@@ -3258,6 +3298,10 @@ FlateStream::FlateStream(Stream *strA, i
      FilterStream(strA) {
    if (predictor != 1) {
      pred = new StreamPredictor(this, predictor, columns, colors, bits);
@@ -95,8 +216,8 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    }
 Index: kpdf/xpdf/xpdf/Stream.h
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.h	(revision 486337)
-+++ kpdf/xpdf/xpdf/Stream.h	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.h	(revision 466932)
++++ kpdf/xpdf/xpdf/Stream.h	(revision 488714)
 @@ -233,6 +233,8 @@ public:
  
    ~StreamPredictor();
@@ -116,8 +237,8 @@ Index: kpdf/xpdf/xpdf/Stream.h
  //------------------------------------------------------------------------
 Index: kpdf/xpdf/xpdf/JPXStream.cc
 ===================================================================
---- kpdf/xpdf/xpdf/JPXStream.cc	(revision 486337)
-+++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/JPXStream.cc	(revision 466932)
++++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 488714)
 @@ -7,6 +7,7 @@
  //========================================================================
  
@@ -152,8 +273,8 @@ Index: kpdf/xpdf/xpdf/JPXStream.cc
  							sizeof(JPXTileComp));
 Index: kpdf/xpdf/goo/gmem.c
 ===================================================================
---- kpdf/xpdf/goo/gmem.c	(revision 486337)
-+++ kpdf/xpdf/goo/gmem.c	(revision 487206)
+--- kpdf/xpdf/goo/gmem.c	(revision 466932)
++++ kpdf/xpdf/goo/gmem.c	(revision 488714)
 @@ -11,6 +11,7 @@
  #include <stdlib.h>
  #include <stddef.h>
@@ -193,8 +314,8 @@ Index: kpdf/xpdf/goo/gmem.c
    GMemHdr *p;
 Index: kpdf/xpdf/goo/gmem.h
 ===================================================================
---- kpdf/xpdf/goo/gmem.h	(revision 486337)
-+++ kpdf/xpdf/goo/gmem.h	(revision 487206)
+--- kpdf/xpdf/goo/gmem.h	(revision 466932)
++++ kpdf/xpdf/goo/gmem.h	(revision 488714)
 @@ -28,6 +28,15 @@ extern void *gmalloc(size_t size);
  extern void *grealloc(void *p, size_t size);
  
diff --git a/kde-base/kpdf/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff b/kde-base/kpdf/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff
index a30fe74a789a..0b6f22303de8 100644
--- a/kde-base/kpdf/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff
+++ b/kde-base/kpdf/files/post-3.5.0-kdegraphics-CAN-2005-3193.diff
@@ -1,7 +1,81 @@
+Index: kpdf/xpdf/xpdf/JBIG2Stream.cc
+===================================================================
+--- kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 481099)
++++ kpdf/xpdf/xpdf/JBIG2Stream.cc	(revision 488715)
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,6 +682,12 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line ) {
++    data = NULL;
++    return;
++  }
++  
+   // need to allocate one extra guard byte for use in combine()
+   data = (Guchar *)gmalloc(h * line + 1);
+   data[h * line] = 0;
+@@ -692,6 +699,12 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
++    data = NULL;
++    return;
++  }
++ 
+   // need to allocate one extra guard byte for use in combine()
+   data = (Guchar *)gmalloc(h * line + 1);
+   memcpy(data, bitmap->data, h * line);
+@@ -720,7 +733,8 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++
++  if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) {
+     return;
+   }
+   // need to allocate one extra guard byte for use in combine()
+@@ -2305,6 +2319,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (h < 0 || w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -2936,6 +2959,9 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
+   JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h)
++    return NULL;
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
 Index: kpdf/xpdf/xpdf/Stream.cc
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.cc	(revision 473213)
-+++ kpdf/xpdf/xpdf/Stream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.cc	(revision 481099)
++++ kpdf/xpdf/xpdf/Stream.cc	(revision 488715)
 @@ -15,6 +15,7 @@
  #include <stdio.h>
  #include <stdlib.h>
@@ -23,7 +97,7 @@ Index: kpdf/xpdf/xpdf/Stream.cc
 +    return;
  
    nVals = width * nComps;
-+  if (nVals + 7 <= 0)
++  if (nVals * nBits + 7 <= 0)
 +    return;
    pixBytes = (nComps * nBits + 7) >> 3;
    rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
@@ -49,12 +123,25 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    } else {
      pred = NULL;
    }
-@@ -2903,7 +2922,11 @@ GBool DCTStream::readBaselineSOF() {
+@@ -1258,8 +1277,9 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
+-  if (columns < 1) {
+-    columns = 1;
++  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++     error(getPos(), "Bad number of columns in CCITTFaxStream");
++     exit(1);
+   }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+@@ -2903,7 +2923,12 @@ GBool DCTStream::readBaselineSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 -  if (prec != 8) {
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream", prec);
 +    return gFalse;
 +  }
@@ -62,29 +149,46 @@ Index: kpdf/xpdf/xpdf/Stream.cc
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
    }
-@@ -2929,6 +2952,10 @@ GBool DCTStream::readProgressiveSOF() {
+@@ -2929,6 +2954,11 @@ GBool DCTStream::readProgressiveSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
 +  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2951,6 +2978,10 @@ GBool DCTStream::readScanInfo() {
+@@ -2951,6 +2981,11 @@ GBool DCTStream::readScanInfo() {
  
    length = read16() - 2;
    scanInfo.numComps = str->getChar();
 +  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    scanInfo.numComps = 0;
 +    error(getPos(), "Bad number of components in DCT stream");
 +    return gFalse;
 +  }
    --length;
    if (length != 2 * scanInfo.numComps + 3) {
      error(getPos(), "Bad DCT scan info block");
-@@ -3833,6 +3864,10 @@ FlateStream::FlateStream(Stream *strA, i
+@@ -3035,12 +3070,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3833,6 +3868,10 @@ FlateStream::FlateStream(Stream *strA, i
      FilterStream(strA) {
    if (predictor != 1) {
      pred = new StreamPredictor(this, predictor, columns, colors, bits);
@@ -97,8 +201,8 @@ Index: kpdf/xpdf/xpdf/Stream.cc
    }
 Index: kpdf/xpdf/xpdf/Stream.h
 ===================================================================
---- kpdf/xpdf/xpdf/Stream.h	(revision 473213)
-+++ kpdf/xpdf/xpdf/Stream.h	(revision 487206)
+--- kpdf/xpdf/xpdf/Stream.h	(revision 481099)
++++ kpdf/xpdf/xpdf/Stream.h	(revision 488715)
 @@ -232,6 +232,8 @@ public:
  
    ~StreamPredictor();
@@ -116,10 +220,8 @@ Index: kpdf/xpdf/xpdf/Stream.h
  };
  
  //------------------------------------------------------------------------
-Index: kpdf/xpdf/xpdf/JPXStream.cc
-===================================================================
---- kpdf/xpdf/xpdf/JPXStream.cc	(revision 473213)
-+++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 487206)
+--- kpdf/xpdf/xpdf/JPXStream.cc	(revision 481099)
++++ kpdf/xpdf/xpdf/JPXStream.cc	(revision 488715)
 @@ -7,6 +7,7 @@
  //========================================================================
  
@@ -153,3 +255,33 @@ Index: kpdf/xpdf/xpdf/JPXStream.cc
        for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
  	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
  							sizeof(JPXTileComp));
+Index: kpdf/xpdf/goo/gmem.c
+===================================================================
+--- kpdf/xpdf/goo/gmem.c	(revision 481099)
++++ kpdf/xpdf/goo/gmem.c	(revision 488715)
+@@ -11,6 +11,7 @@
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <string.h>
++#include <limits.h>
+ #include "gmem.h"
+ 
+ #ifdef DEBUG_MEM
+@@ -141,7 +142,7 @@ void *gmallocn(int nObjs, int objSize) {
+   int n;
+ 
+   n = nObjs * objSize;
+-  if (objSize == 0 || n / objSize != nObjs) {
++  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+     fprintf(stderr, "Bogus memory allocation size\n");
+     exit(1);
+   }
+@@ -152,7 +153,7 @@ void *greallocn(void *p, int nObjs, int 
+   int n;
+ 
+   n = nObjs * objSize;
+-  if (objSize == 0 || n / objSize != nObjs) {
++  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+     fprintf(stderr, "Bogus memory allocation size\n");
+     exit(1);
+   }
diff --git a/kde-base/kpdf/kpdf-3.4.3-r3.ebuild b/kde-base/kpdf/kpdf-3.4.3-r3.ebuild
new file mode 100644
index 000000000000..c6434781c201
--- /dev/null
+++ b/kde-base/kpdf/kpdf-3.4.3-r3.ebuild
@@ -0,0 +1,23 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/kpdf-3.4.3-r3.ebuild,v 1.1 2005/12/20 17:42:35 carlo Exp $
+
+KMNAME=kdegraphics
+MAXKDEVER=$PV
+KM_DEPRANGE="$PV $MAXKDEVER"
+inherit kde-meta
+
+DESCRIPTION="kpdf, a kde pdf viewer based on xpdf"
+KEYWORDS="~alpha ~amd64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="nodrm"
+KMEXTRA="kfile-plugins/pdf"
+
+DEPEND=">=media-libs/freetype-2.0.5 media-libs/t1lib"
+
+PATCHES="${FILESDIR}/post-3.4.3-kdegraphics-CAN-2005-3193.diff"
+
+src_compile() {
+	myconf="${myconf} $(use_enable !nodrm kpdf-drm)"
+
+	kde-meta_src_compile
+}
diff --git a/kde-base/kpdf/kpdf-3.5.0-r3.ebuild b/kde-base/kpdf/kpdf-3.5.0-r3.ebuild
new file mode 100644
index 000000000000..afe4746b8086
--- /dev/null
+++ b/kde-base/kpdf/kpdf-3.5.0-r3.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/kpdf-3.5.0-r3.ebuild,v 1.1 2005/12/20 17:42:35 carlo Exp $
+
+KMNAME=kdegraphics
+MAXKDEVER=$PV
+KM_DEPRANGE="$PV $MAXKDEVER"
+inherit kde-meta
+
+DESCRIPTION="kpdf, a kde pdf viewer based on xpdf"
+KEYWORDS="~alpha ~amd64 ~ppc64 ~sparc ~x86"
+IUSE=""
+KMEXTRA="kfile-plugins/pdf"
+
+DEPEND=">=media-libs/freetype-2.0.5
+	media-libs/t1lib
+	>=app-text/poppler-0.3.1"
+
+PATCHES="${FILESDIR}/post-3.5.0-kdegraphics-CAN-2005-3193.diff
+	${FILESDIR}/kpdf-3.5.0-splitter-io.patch
+	${FILESDIR}/kpdf-3.5.0-cropbox-fix.patch"
+
+pkg_setup() {
+	if ! built_with_use app-text/poppler qt; then
+		eerror "This package requires app-text/poppler compiled with Qt support."
+		eerror "Please reemerge app-text/poppler with USE=\"qt\"."
+		die "Please reemerge app-text/poppler with USE=\"qt\"."
+	fi
+}
+
+src_compile() {
+	local myconf="--with-poppler"
+
+	kde-meta_src_compile
+}