Description: fix invalid memory access issues
Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=9529e776e53e71069ba4215cdb8b84592d37b555
Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=e5661e1a08c38d4c8d69976a8c1c02c1102bc88c
Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=d0df8e54512f584ca2b3edbae1c19e167948e5c3
Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492
Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=e14b6e9c13d35c9bd1e0c50906ace8e707816888
Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=0388837f01bc467045164f9ddaff787000a8caaa
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702071

Index: poppler-0.16.7/poppler/Function.cc
===================================================================
--- poppler-0.16.7.orig/poppler/Function.cc	2013-03-27 10:18:19.704260518 -0400
+++ poppler-0.16.7/poppler/Function.cc	2013-03-27 10:18:19.696260518 -0400
@@ -261,6 +261,10 @@
       goto err3;
     }
     sampleSize[i] = obj2.getInt();
+    if (sampleSize[i] <= 0) {
+      error(-1, "Illegal non-positive value in function size array");
+      goto err3;
+    }
     obj2.free();
   }
   obj1.free();
@@ -953,6 +957,10 @@
       return;
     }
     --sp;
+    if (sp + i + 1 >= psStackSize) {
+      error(-1, "Stack underflow in PostScript function");
+      return;
+    }
     stack[sp] = stack[sp + 1 + i];
   }
   void pop()
@@ -1001,6 +1009,10 @@
     error(-1, "Stack underflow in PostScript function");
     return;
   }
+  if (unlikely(sp - n > psStackSize)) {
+    error(-1, "Stack underflow in PostScript function");
+    return;
+  }
   if (!checkOverflow(n)) {
     return;
   }
@@ -1025,7 +1037,7 @@
       j = n - j;
     }
   }
-  if (n <= 0 || j == 0) {
+  if (n <= 0 || j == 0 || n > psStackSize || sp + n > psStackSize) {
     return;
   }
   if (j <= n / 2) {
Index: poppler-0.16.7/poppler/Stream.cc
===================================================================
--- poppler-0.16.7.orig/poppler/Stream.cc	2013-03-27 10:18:19.704260518 -0400
+++ poppler-0.16.7/poppler/Stream.cc	2013-03-27 10:18:19.696260518 -0400
@@ -2131,7 +2131,8 @@
 
 // clip [-256,511] --> [0,255]
 #define dctClipOffset 256
-static Guchar dctClip[768];
+#define dctClipLength 768
+static Guchar dctClip[dctClipLength];
 static int dctClipInit = 0;
 
 // zig zag decode map
@@ -3077,7 +3078,12 @@
 
   // convert to 8-bit integers
   for (i = 0; i < 64; ++i) {
-    dataOut[i] = dctClip[dctClipOffset + 128 + ((dataIn[i] + 8) >> 4)];
+    const int ix = dctClipOffset + 128 + ((dataIn[i] + 8) >> 4);
+    if (unlikely(ix < 0 || ix >= dctClipLength)) {
+      dataOut[i] = 0;
+    } else {
+      dataOut[i] = dctClip[ix];
+    }
   }
 }
 
Index: poppler-0.16.7/splash/Splash.cc
===================================================================
--- poppler-0.16.7.orig/splash/Splash.cc	2013-03-27 10:18:19.704260518 -0400
+++ poppler-0.16.7/splash/Splash.cc	2013-03-27 10:18:19.700260518 -0400
@@ -1497,11 +1497,14 @@
   lineDashStartPhase -= (SplashCoord)i * lineDashTotal;
   lineDashStartOn = gTrue;
   lineDashStartIdx = 0;
-  while (lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
+  while (lineDashStartIdx < state->lineDashLength && lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
     lineDashStartOn = !lineDashStartOn;
     lineDashStartPhase -= state->lineDash[lineDashStartIdx];
     ++lineDashStartIdx;
   }
+    if (unlikely(lineDashStartIdx == state->lineDashLength)) {
+      return new SplashPath();
+    }
 
   dPath = new SplashPath();