--- /dev/null
+*** ./xpdf/Gfx.cc.orig Sun Dec 12 16:04:43 2004
+--- ./xpdf/Gfx.cc Sun Dec 12 16:05:16 2004
+***************
+*** 2654,2660 ****
+ haveMask = gFalse;
+ dict->lookup("Mask", &maskObj);
+ if (maskObj.isArray()) {
+! for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+ maskObj.arrayGet(i, &obj1);
+ maskColors[i] = obj1.getInt();
+ obj1.free();
+--- 2654,2662 ----
+ haveMask = gFalse;
+ dict->lookup("Mask", &maskObj);
+ if (maskObj.isArray()) {
+! for (i = 0;
+! i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+! ++i) {
+ maskObj.arrayGet(i, &obj1);
+ maskColors[i] = obj1.getInt();
+ obj1.free();
+*** ./xpdf/GfxState.cc.orig Sun Dec 12 16:04:48 2004
+--- ./xpdf/GfxState.cc Sun Dec 12 16:06:38 2004
+***************
+*** 708,713 ****
+--- 708,718 ----
+ }
+ nCompsA = obj2.getInt();
+ obj2.free();
++ if (nCompsA > gfxColorMaxComps) {
++ error(-1, "ICCBased color space with too many (%d > %d) components",
++ nCompsA, gfxColorMaxComps);
++ nCompsA = gfxColorMaxComps;
++ }
+ if (dict->lookup("Alternate", &obj2)->isNull() ||
+ !(altA = GfxColorSpace::parse(&obj2))) {
+ switch (nCompsA) {
+***************
+*** 1054,1060 ****
+ }
+ nCompsA = obj1.arrayGetLength();
+ if (nCompsA > gfxColorMaxComps) {
+! error(-1, "DeviceN color space with more than %d > %d components",
+ nCompsA, gfxColorMaxComps);
+ nCompsA = gfxColorMaxComps;
+ }
+--- 1059,1065 ----
+ }
+ nCompsA = obj1.arrayGetLength();
+ if (nCompsA > gfxColorMaxComps) {
+! error(-1, "DeviceN color space with too many (%d > %d) components",
+ nCompsA, gfxColorMaxComps);
+ nCompsA = gfxColorMaxComps;
+ }