Revision bump, fix security bug 264603, thanks to Robert Buchholz for the patches, and font hiding, bug 241678, thanks to Alex Efros for the patch

Package-Manager: portage-2.2_rc33/cvs/Linux x86_64

6 files changed, 102 insertions, 646 deletions

diff --git a/kde-base/kpdf/ChangeLog b/kde-base/kpdf/ChangeLog
index f9c8b0fbcc8f..c00d65d11c73 100644
--- a/kde-base/kpdf/ChangeLog
+++ b/kde-base/kpdf/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for kde-base/kpdf
 # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/ChangeLog,v 1.164 2009/03/30 13:01:09 loki_val Exp $
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/ChangeLog,v 1.165 2009/05/29 15:44:30 tampakrap Exp $
+
+*kpdf-3.5.10-r1 (29 May 2009)
+
+  29 May 2009; Theo Chatzimichos <tampakrap@gentoo.org>
+  -files/post-3.5.8-kdegraphics-kpdf.diff, +kpdf-3.5.10-r1.ebuild,
+  +files/kpdf-3.5.10-font-hiding.patch, +files/kde-CVE-2009-1188.patch:
+  Revision bump, fix security bug 264603, thanks to Robert Buchholz for the
+  patches, and font hiding, bug 241678, thanks to Alex Efros for the patch
 
   30 Mar 2009; Peter Alfredsen <loki_val@gentoo.org> kpdf-3.5.9.ebuild,
   kpdf-3.5.10.ebuild:
diff --git a/kde-base/kpdf/Manifest b/kde-base/kpdf/Manifest
index 10c1049fee5f..cc683b1e9585 100644
--- a/kde-base/kpdf/Manifest
+++ b/kde-base/kpdf/Manifest
@@ -1,7 +1,20 @@
-AUX post-3.5.8-kdegraphics-kpdf.diff 17412 RMD160 e8202b93098ae0523d4f2fbf3661648904a6619b SHA1 fea08298b8f9228ed57ddf0ceffcab12755c1e80 SHA256 266c60858c1e4671f5540fa767d0efd83a5c9530de931de41b14ebaf3dcfb529
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+AUX kde-CVE-2009-1188.patch 491 RMD160 4b97605d34ca86894fe55a13bff3887468753b8b SHA1 3d3b00f3aaa53a5a17786559261c9089937be5da SHA256 592c9646aed0fade9c12dbadcfa91704e0430942078d8285bed29d9d70adaa3c
+AUX kpdf-3.5.10-font-hiding.patch 1053 RMD160 c61ec316deca92ea96926d9697191ac9525f3c6a SHA1 b83ca9a57514fbddcc5a09e12f3024457c831415 SHA256 8f06a56423579cab9a017ccf4cca7cd7cce40d6e12638ddc4640d3fed2611248
 DIST kdegraphics-3.5.10.tar.bz2 7440912 RMD160 94278e4419ab99885fc9efae9b6ba5ba787f831e SHA1 9634e3ab364d017152fb6d636efad8811aeec6c3 SHA256 bdc73fa98008aa64b72636282bf0d83c7bb3e6d4ba1d0831277dda469b57408b
 DIST kdegraphics-3.5.9.tar.bz2 7441533 RMD160 047a02352858300b6be8db686e95fc55d257ac2d SHA1 62062f2e0274c4fb35e4988ede10072b0267ada7 SHA256 81514a8234158522440b0ecd269dbeb2e3622f72956fcdf38e726866d8100cb2
+DIST kpdf-3.5.10-JBIG2.tar.bz2 5533 RMD160 58bbb77e5d98abdfd3fe629dc34d6f53e67b4c3d SHA1 2d74673ee085ba8f22e4f27c323e5902f34dd525 SHA256 37a1e35b6a4a9ae8324ab5894cae216375c7d05b136386698bc23feca014ddb4
+EBUILD kpdf-3.5.10-r1.ebuild 1003 RMD160 9b0f7c15a18e3d9f47ad138c0561004432e29609 SHA1 d9cc3bc5d812276415d845ff7a4765511d7d7003 SHA256 4ec68c1f5350d281b35e47d54fc77d5046a8986d3d2ee6910c1914e8e4baa7fd
 EBUILD kpdf-3.5.10.ebuild 821 RMD160 d311cf93990557a4987b2153b924f8ad9495a5be SHA1 de3cd99e8292ea3524c3619f17bea1b976e26902 SHA256 a3c64b449593e6eaeb012ee14a54954e70335828bf0dc0954cd1c010611f7577
 EBUILD kpdf-3.5.9.ebuild 812 RMD160 feb3cd2ea03f726be1c94cd7c1695cfa95a8db13 SHA1 3509c63f59921bec7de9f0ddbeec5f57f0cd96b4 SHA256 678747c98be760823d35341579745a38ae746303157e2181c231e085a5a400d8
-MISC ChangeLog 22314 RMD160 6f1309107477505c0c9654a3573c33f2b02635a3 SHA1 6bb23a0ef9b5c8f2ab4cd194fd43600f4c926906 SHA256 3986168baddf471a9688a24e4b9d3b2d7a6c09ccb8f022160530fe4f9c5fcf6f
+MISC ChangeLog 22693 RMD160 28074c2bd1a550e715779ae93ad6a85495719ad2 SHA1 045655ba11a4cbed73a358953b72d8be07f92c15 SHA256 1faadfb645ac723eddd63536884fd7a3e5f66bbc216bfeb12a9f0e2556c3db02
 MISC metadata.xml 156 RMD160 ecce3b981f150c45ae1e84e2d208e678d6124259 SHA1 b64f7c0b4e5db816d82ad19848f72118af129d35 SHA256 2f4da28506b9d4185f320f67a6191d30c7a921217ed4447ed46ea0bc4aefc79a
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.11 (GNU/Linux)
+
+iEYEARECAAYFAkogAucACgkQjDdoMVfcAHifdACdHJxLIKk8W/mAuEy5RFckRK3V
+/ZsAoNymRwXKCUvlRgzWaF4fxTuJeejp
+=hpEw
+-----END PGP SIGNATURE-----
diff --git a/kde-base/kpdf/files/kde-CVE-2009-1188.patch b/kde-base/kpdf/files/kde-CVE-2009-1188.patch
new file mode 100644
index 000000000000..952a430cd903
--- /dev/null
+++ b/kde-base/kpdf/files/kde-CVE-2009-1188.patch
@@ -0,0 +1,13 @@
+Index: xpdf-3.02/splash/SplashBitmap.cc
+===================================================================
+--- kpdf/xpdf/splash/SplashBitmap.cc
++++ kpdf/xpdf/splash/SplashBitmap.cc
+@@ -44,7 +44,7 @@ SplashBitmap::SplashBitmap(int widthA, i
+   }
+   rowSize += rowPad - 1;
+   rowSize -= rowSize % rowPad;
+-  data = (SplashColorPtr)gmalloc(rowSize * height);
++  data = (SplashColorPtr)gmallocn(rowSize, height);
+   if (!topDown) {
+     data += (height - 1) * rowSize;
+     rowSize = -rowSize;
diff --git a/kde-base/kpdf/files/kpdf-3.5.10-font-hiding.patch b/kde-base/kpdf/files/kpdf-3.5.10-font-hiding.patch
new file mode 100644
index 000000000000..5c35b9c9a637
--- /dev/null
+++ b/kde-base/kpdf/files/kpdf-3.5.10-font-hiding.patch
@@ -0,0 +1,30 @@
+--- kpdf-3.5.9/kpdf/xpdf/splash/SplashFTFont.cc.orig	2008-10-13 04:57:41.000000000 +0300
++++ kpdf-3.5.9/kpdf/xpdf/splash/SplashFTFont.cc	2008-10-13 04:57:49.000000000 +0300
+@@ -180,12 +180,12 @@
+   }
+ 
+   // if we have the FT2 bytecode interpreter, autohinting won't be used
+-#ifdef TT_CONFIG_OPTION_BYTECODE_INTERPRETER
+-  if (FT_Load_Glyph(ff->face, gid,
+-		    aa ? FT_LOAD_NO_BITMAP : FT_LOAD_DEFAULT)) {
+-    return gFalse;
+-  }
+-#else
++//#ifdef TT_CONFIG_OPTION_BYTECODE_INTERPRETER
++//  if (FT_Load_Glyph(ff->face, gid,
++//		    aa ? FT_LOAD_NO_BITMAP : FT_LOAD_DEFAULT)) {
++//    return gFalse;
++//  }
++//#else
+   // FT2's autohinting doesn't always work very well (especially with
+   // font subsets), so turn it off if anti-aliasing is enabled; if
+   // anti-aliasing is disabled, this seems to be a tossup - some fonts
+@@ -195,7 +195,7 @@
+                        : FT_LOAD_DEFAULT)) {
+     return gFalse;
+   }
+-#endif
++//#endif
+ 
+   FT_Glyph_Metrics *glyphMetrics = &(ff->face->glyph->metrics);
+   // prelimirary values from FT_Glyph_Metrics
diff --git a/kde-base/kpdf/files/post-3.5.8-kdegraphics-kpdf.diff b/kde-base/kpdf/files/post-3.5.8-kdegraphics-kpdf.diff
deleted file mode 100644
index 94e44a0280e9..000000000000
--- a/kde-base/kpdf/files/post-3.5.8-kdegraphics-kpdf.diff
+++ /dev/null
@@ -1,643 +0,0 @@
---- kpdf/xpdf/xpdf/Stream.cc
-+++ kpdf/xpdf/xpdf/Stream.cc
-@@ -1245,23 +1245,26 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
-   columns = columnsA;
-   if (columns < 1) {
-     columns = 1;
--  }
--  if (columns + 4 <= 0) {
--    columns = INT_MAX - 4;
-+  } else if (columns > INT_MAX - 2) {
-+    columns = INT_MAX - 2;
-   }
-   rows = rowsA;
-   endOfBlock = endOfBlockA;
-   black = blackA;
--  refLine = (short *)gmallocn(columns + 3, sizeof(short));
--  codingLine = (short *)gmallocn(columns + 2, sizeof(short));
-+  // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
-+  // ---> max codingLine size = columns + 1
-+  // refLine has one extra guard entry at the end
-+  // ---> max refLine size = columns + 2
-+  codingLine = (int *)gmallocn(columns + 1, sizeof(int));
-+  refLine = (int *)gmallocn(columns + 2, sizeof(int));
- 
-   eof = gFalse;
-   row = 0;
-   nextLine2D = encoding < 0;
-   inputBits = 0;
--  codingLine[0] = 0;
--  codingLine[1] = refLine[2] = columns;
--  a0 = 1;
-+  codingLine[0] = columns;
-+  a0i = 0;
-+  outputBits = 0;
- 
-   buf = EOF;
- }
-@@ -1280,9 +1283,9 @@ void CCITTFaxStream::reset() {
-   row = 0;
-   nextLine2D = encoding < 0;
-   inputBits = 0;
--  codingLine[0] = 0;
--  codingLine[1] = columns;
--  a0 = 1;
-+  codingLine[0] = columns;
-+  a0i = 0;
-+  outputBits = 0;
-   buf = EOF;
- 
-   // skip any initial zero bits and end-of-line marker, and get the 2D
-@@ -1299,211 +1302,230 @@ void CCITTFaxStream::reset() {
-   }
- }
- 
-+inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
-+  if (a1 > codingLine[a0i]) {
-+    if (a1 > columns) {
-+      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
-+      err = gTrue;
-+      a1 = columns;
-+    }
-+    if ((a0i & 1) ^ blackPixels) {
-+      ++a0i;
-+    }
-+    codingLine[a0i] = a1;
-+  }
-+}
-+
-+inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
-+  if (a1 > codingLine[a0i]) {
-+    if (a1 > columns) {
-+      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
-+      err = gTrue;
-+      a1 = columns;
-+    }
-+    if ((a0i & 1) ^ blackPixels) {
-+      ++a0i;
-+    }
-+    codingLine[a0i] = a1;
-+  } else if (a1 < codingLine[a0i]) {
-+    if (a1 < 0) {
-+      error(getPos(), "Invalid CCITTFax code");
-+      err = gTrue;
-+      a1 = 0;
-+    }
-+    while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
-+      --a0i;
-+    }
-+    codingLine[a0i] = a1;
-+  }
-+}
-+
- int CCITTFaxStream::lookChar() {
-   short code1, code2, code3;
--  int a0New;
--  GBool err, gotEOL;
--  int ret;
--  int bits, i;
-+  int b1i, blackPixels, i, bits;
-+  GBool gotEOL;
- 
--  // if at eof just return EOF
--  if (eof && codingLine[a0] >= columns) {
--    return EOF;
-+  if (buf != EOF) {
-+    return buf;
-   }
- 
-   // read the next row
--  err = gFalse;
--  if (codingLine[a0] >= columns) {
-+  if (outputBits == 0) {
-+
-+    // if at eof just return EOF
-+    if (eof) {
-+      return EOF;
-+    }
-+
-+    err = gFalse;
- 
-     // 2-D encoding
-     if (nextLine2D) {
--      // state:
--      //   a0New = current position in coding line (0 <= a0New <= columns)
--      //   codingLine[a0] = last change in coding line
--      //                    (black-to-white if a0 is even,
--      //                     white-to-black if a0 is odd)
--      //   refLine[b1] = next change in reference line of opposite color
--      //                 to a0
--      // invariants:
--      //   0 <= codingLine[a0] <= a0New
--      //           <= refLine[b1] <= refLine[b1+1] <= columns
--      //   0 <= a0 <= columns+1
--      //   refLine[0] = 0
--      //   refLine[n] = refLine[n+1] = columns
--      //     -- for some 1 <= n <= columns+1
--      // end condition:
--      //   0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
--      //     < codingLine[n-1] < codingLine[n] = columns
--      //     -- where 1 <= n <= columns+1
-       for (i = 0; codingLine[i] < columns; ++i) {
- 	refLine[i] = codingLine[i];
-       }
--      refLine[i] = refLine[i + 1] = columns;
--      b1 = 1;
--      a0New = codingLine[a0 = 0] = 0;
--      do {
-+      refLine[i++] = columns;
-+      refLine[i] = columns;
-+      codingLine[0] = 0;
-+      a0i = 0;
-+      b1i = 0;
-+      blackPixels = 0;
-+      // invariant:
-+      // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
-+      //                                                             <= columns
-+      // exception at left edge:
-+      //   codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
-+      // exception at right edge:
-+      //   refLine[b1i] = refLine[b1i+1] = columns is possible
-+      while (codingLine[a0i] < columns) {
- 	code1 = getTwoDimCode();
- 	switch (code1) {
- 	case twoDimPass:
--	  if (refLine[b1] < columns) {
--	    a0New = refLine[b1 + 1];
--	    b1 += 2;
-+	  addPixels(refLine[b1i + 1], blackPixels);
-+	  if (refLine[b1i + 1] < columns) {
-+	    b1i += 2;
- 	  }
- 	  break;
- 	case twoDimHoriz:
--	  if ((a0 & 1) == 0) {
--	    code1 = code2 = 0;
-+	  code1 = code2 = 0;
-+	  if (blackPixels) {
- 	    do {
--	      code1 += code3 = getWhiteCode();
-+	      code1 += code3 = getBlackCode();
- 	    } while (code3 >= 64);
- 	    do {
--	      code2 += code3 = getBlackCode();
-+	      code2 += code3 = getWhiteCode();
- 	    } while (code3 >= 64);
- 	  } else {
--	    code1 = code2 = 0;
- 	    do {
--	      code1 += code3 = getBlackCode();
-+	      code1 += code3 = getWhiteCode();
- 	    } while (code3 >= 64);
- 	    do {
--	      code2 += code3 = getWhiteCode();
-+	      code2 += code3 = getBlackCode();
- 	    } while (code3 >= 64);
- 	  }
--	  if (code1 > 0 || code2 > 0) {
--	    if (a0New + code1 <= columns) {
--	      codingLine[a0 + 1] = a0New + code1;
--	    } else {
--	      codingLine[a0 + 1] = columns;
--	    }
--	    ++a0;
--	    if (codingLine[a0] + code2 <= columns) {
--	      codingLine[a0 + 1] = codingLine[a0] + code2;
--	    } else {
--	      codingLine[a0 + 1] = columns;
--	    }
--	    ++a0;
--	    a0New = codingLine[a0];
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	  addPixels(codingLine[a0i] + code1, blackPixels);
-+	  if (codingLine[a0i] < columns) {
-+	    addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
-+	  }
-+	  while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	    b1i += 2;
-+	  }
-+	  break;
-+	case twoDimVertR3:
-+	  addPixels(refLine[b1i] + 3, blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    ++b1i;
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
- 	  }
- 	  break;
--	case twoDimVert0:
--	  if (refLine[b1] < columns) {
--	    a0New = codingLine[++a0] = refLine[b1];
--	    ++b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	case twoDimVertR2:
-+	  addPixels(refLine[b1i] + 2, blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    ++b1i;
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
--	  } else {
--	    a0New = codingLine[++a0] = columns;
- 	  }
- 	  break;
- 	case twoDimVertR1:
--	  if (refLine[b1] + 1 < columns) {
--	    a0New = codingLine[++a0] = refLine[b1] + 1;
--	    ++b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	  addPixels(refLine[b1i] + 1, blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    ++b1i;
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
--	  } else {
--	    a0New = codingLine[++a0] = columns;
- 	  }
- 	  break;
--	case twoDimVertL1:
--	  if (refLine[b1] - 1 > a0New || (a0 == 0 && refLine[b1] == 1)) {
--	    a0New = codingLine[++a0] = refLine[b1] - 1;
--	    --b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	case twoDimVert0:
-+	  addPixels(refLine[b1i], blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    ++b1i;
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
- 	  }
- 	  break;
--	case twoDimVertR2:
--	  if (refLine[b1] + 2 < columns) {
--	    a0New = codingLine[++a0] = refLine[b1] + 2;
--	    ++b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	case twoDimVertL3:
-+	  addPixelsNeg(refLine[b1i] - 3, blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    if (b1i > 0) {
-+	      --b1i;
-+	    } else {
-+	      ++b1i;
-+	    }
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
--	  } else {
--	    a0New = codingLine[++a0] = columns;
- 	  }
- 	  break;
- 	case twoDimVertL2:
--	  if (refLine[b1] - 2 > a0New || (a0 == 0 && refLine[b1] == 2)) {
--	    a0New = codingLine[++a0] = refLine[b1] - 2;
--	    --b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	  addPixelsNeg(refLine[b1i] - 2, blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    if (b1i > 0) {
-+	      --b1i;
-+	    } else {
-+	      ++b1i;
- 	    }
--	  }
--	  break;
--	case twoDimVertR3:
--	  if (refLine[b1] + 3 < columns) {
--	    a0New = codingLine[++a0] = refLine[b1] + 3;
--	    ++b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
--	  } else {
--	    a0New = codingLine[++a0] = columns;
- 	  }
- 	  break;
--	case twoDimVertL3:
--	  if (refLine[b1] - 3 > a0New || (a0 == 0 && refLine[b1] == 3)) {
--	    a0New = codingLine[++a0] = refLine[b1] - 3;
--	    --b1;
--	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
--	      b1 += 2;
-+	case twoDimVertL1:
-+	  addPixelsNeg(refLine[b1i] - 1, blackPixels);
-+	  blackPixels ^= 1;
-+	  if (codingLine[a0i] < columns) {
-+	    if (b1i > 0) {
-+	      --b1i;
-+	    } else {
-+	      ++b1i;
-+	    }
-+	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
-+	      b1i += 2;
- 	    }
- 	  }
- 	  break;
- 	case EOF:
-+	  addPixels(columns, 0);
- 	  eof = gTrue;
--	  codingLine[a0 = 0] = columns;
--	  return EOF;
-+	  break;
- 	default:
- 	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
-+	  addPixels(columns, 0);
- 	  err = gTrue;
- 	  break;
- 	}
--      } while (codingLine[a0] < columns);
-+      }
- 
-     // 1-D encoding
-     } else {
--      codingLine[a0 = 0] = 0;
--      while (1) {
-+      codingLine[0] = 0;
-+      a0i = 0;
-+      blackPixels = 0;
-+      while (codingLine[a0i] < columns) {
- 	code1 = 0;
--	do {
--	  code1 += code3 = getWhiteCode();
--	} while (code3 >= 64);
--	codingLine[a0+1] = codingLine[a0] + code1;
--	++a0;
--	if (codingLine[a0] >= columns) {
--	  break;
--	}
--	code2 = 0;
--	do {
--	  code2 += code3 = getBlackCode();
--	} while (code3 >= 64);
--	codingLine[a0+1] = codingLine[a0] + code2;
--	++a0;
--	if (codingLine[a0] >= columns) {
--	  break;
-+	if (blackPixels) {
-+	  do {
-+	    code1 += code3 = getBlackCode();
-+	  } while (code3 >= 64);
-+	} else {
-+	  do {
-+	    code1 += code3 = getWhiteCode();
-+	  } while (code3 >= 64);
- 	}
-+	addPixels(codingLine[a0i] + code1, blackPixels);
-+	blackPixels ^= 1;
-       }
-     }
- 
--    if (codingLine[a0] != columns) {
--      error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
--      // force the row to be the correct length
--      while (codingLine[a0] > columns) {
--	--a0;
--      }
--      codingLine[++a0] = columns;
--      err = gTrue;
--    }
--
-     // byte-align the row
-     if (byteAlign) {
-       inputBits &= ~7;
-@@ -1562,14 +1584,17 @@ int CCITTFaxStream::lookChar() {
-     // this if we know the stream contains end-of-line markers because
-     // the "just plow on" technique tends to work better otherwise
-     } else if (err && endOfLine) {
--      do {
-+      while (1) {
-+	code1 = lookBits(13);
- 	if (code1 == EOF) {
- 	  eof = gTrue;
- 	  return EOF;
- 	}
-+	if ((code1 >> 1) == 0x001) {
-+	  break;
-+	}
- 	eatBits(1);
--	code1 = lookBits(13);
--      } while ((code1 >> 1) != 0x001);
-+      }
-       eatBits(12); 
-       if (encoding > 0) {
- 	eatBits(1);
-@@ -1577,11 +1602,11 @@ int CCITTFaxStream::lookChar() {
-       }
-     }
- 
--    a0 = 0;
--    outputBits = codingLine[1] - codingLine[0];
--    if (outputBits == 0) {
--      a0 = 1;
--      outputBits = codingLine[2] - codingLine[1];
-+    // set up for output
-+    if (codingLine[0] > 0) {
-+      outputBits = codingLine[a0i = 0];
-+    } else {
-+      outputBits = codingLine[a0i = 1];
-     }
- 
-     ++row;
-@@ -1589,39 +1614,43 @@ int CCITTFaxStream::lookChar() {
- 
-   // get a byte
-   if (outputBits >= 8) {
--    ret = ((a0 & 1) == 0) ? 0xff : 0x00;
--    if ((outputBits -= 8) == 0) {
--      ++a0;
--      if (codingLine[a0] < columns) {
--	outputBits = codingLine[a0 + 1] - codingLine[a0];
--      }
-+    buf = (a0i & 1) ? 0x00 : 0xff;
-+    outputBits -= 8;
-+    if (outputBits == 0 && codingLine[a0i] < columns) {
-+      ++a0i;
-+      outputBits = codingLine[a0i] - codingLine[a0i - 1];
-     }
-   } else {
-     bits = 8;
--    ret = 0;
-+    buf = 0;
-     do {
-       if (outputBits > bits) {
--	i = bits;
--	bits = 0;
--	if ((a0 & 1) == 0) {
--	  ret |= 0xff >> (8 - i);
-+	buf <<= bits;
-+	if (!(a0i & 1)) {
-+	  buf |= 0xff >> (8 - bits);
- 	}
--	outputBits -= i;
-+	outputBits -= bits;
-+	bits = 0;
-       } else {
--	i = outputBits;
--	bits -= outputBits;
--	if ((a0 & 1) == 0) {
--	  ret |= (0xff >> (8 - i)) << bits;
-+	buf <<= outputBits;
-+	if (!(a0i & 1)) {
-+	  buf |= 0xff >> (8 - outputBits);
- 	}
-+	bits -= outputBits;
- 	outputBits = 0;
--	++a0;
--	if (codingLine[a0] < columns) {
--	  outputBits = codingLine[a0 + 1] - codingLine[a0];
-+	if (codingLine[a0i] < columns) {
-+	  ++a0i;
-+	  outputBits = codingLine[a0i] - codingLine[a0i - 1];
-+	} else if (bits > 0) {
-+	  buf <<= bits;
-+	  bits = 0;
- 	}
-       }
--    } while (bits > 0 && codingLine[a0] < columns);
-+    } while (bits);
-+  }
-+  if (black) {
-+    buf ^= 0xff;
-   }
--  buf = black ? (ret ^ 0xff) : ret;
-   return buf;
- }
- 
-@@ -1663,6 +1692,9 @@ short CCITTFaxStream::getWhiteCode() {
-   code = 0; // make gcc happy
-   if (endOfBlock) {
-     code = lookBits(12);
-+    if (code == EOF) {
-+      return 1;
-+    }
-     if ((code >> 5) == 0) {
-       p = &whiteTab1[code];
-     } else {
-@@ -1675,6 +1707,9 @@ short CCITTFaxStream::getWhiteCode() {
-   } else {
-     for (n = 1; n <= 9; ++n) {
-       code = lookBits(n);
-+      if (code == EOF) {
-+	return 1;
-+      }
-       if (n < 9) {
- 	code <<= 9 - n;
-       }
-@@ -1686,6 +1721,9 @@ short CCITTFaxStream::getWhiteCode() {
-     }
-     for (n = 11; n <= 12; ++n) {
-       code = lookBits(n);
-+      if (code == EOF) {
-+	return 1;
-+      }
-       if (n < 12) {
- 	code <<= 12 - n;
-       }
-@@ -1711,9 +1749,12 @@ short CCITTFaxStream::getBlackCode() {
-   code = 0; // make gcc happy
-   if (endOfBlock) {
-     code = lookBits(13);
-+    if (code == EOF) {
-+      return 1;
-+    }
-     if ((code >> 7) == 0) {
-       p = &blackTab1[code];
--    } else if ((code >> 9) == 0) {
-+    } else if ((code >> 9) == 0 && (code >> 7) != 0) {
-       p = &blackTab2[(code >> 1) - 64];
-     } else {
-       p = &blackTab3[code >> 7];
-@@ -1725,6 +1766,9 @@ short CCITTFaxStream::getBlackCode() {
-   } else {
-     for (n = 2; n <= 6; ++n) {
-       code = lookBits(n);
-+      if (code == EOF) {
-+	return 1;
-+      }
-       if (n < 6) {
- 	code <<= 6 - n;
-       }
-@@ -1736,6 +1780,9 @@ short CCITTFaxStream::getBlackCode() {
-     }
-     for (n = 7; n <= 12; ++n) {
-       code = lookBits(n);
-+      if (code == EOF) {
-+	return 1;
-+      }
-       if (n < 12) {
- 	code <<= 12 - n;
-       }
-@@ -1749,6 +1796,9 @@ short CCITTFaxStream::getBlackCode() {
-     }
-     for (n = 10; n <= 13; ++n) {
-       code = lookBits(n);
-+      if (code == EOF) {
-+	return 1;
-+      }
-       if (n < 13) {
- 	code <<= 13 - n;
-       }
-@@ -1963,6 +2013,12 @@ void DCTStream::reset() {
-     // allocate a buffer for the whole image
-     bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
-     bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
-+    if (bufWidth <= 0 || bufHeight <= 0 ||
-+	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
-+      error(getPos(), "Invalid image size in DCT stream");
-+      y = height;
-+      return;
-+    }
-     for (i = 0; i < numComps; ++i) {
-       frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
-       memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
-@@ -3038,6 +3094,11 @@ GBool DCTStream::readScanInfo() {
-   }
-   scanInfo.firstCoeff = str->getChar();
-   scanInfo.lastCoeff = str->getChar();
-+  if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
-+      scanInfo.firstCoeff > scanInfo.lastCoeff) {
-+    error(getPos(), "Bad DCT coefficient numbers in scan info block");
-+    return gFalse;
-+  }
-   c = str->getChar();
-   scanInfo.ah = (c >> 4) & 0x0f;
-   scanInfo.al = c & 0x0f;
---- kpdf/xpdf/xpdf/Stream.h
-+++ kpdf/xpdf/xpdf/Stream.h
-@@ -528,13 +528,15 @@ private:
-   int row;			// current row
-   int inputBuf;			// input buffer
-   int inputBits;		// number of bits in input buffer
--  short *refLine;		// reference line changing elements
--  int b1;			// index into refLine
--  short *codingLine;		// coding line changing elements
--  int a0;			// index into codingLine
-+  int *codingLine;		// coding line changing elements
-+  int *refLine;			// reference line changing elements
-+  int a0i;			// index into codingLine
-+  GBool err;			// error on current line
-   int outputBits;		// remaining ouput bits
-   int buf;			// character buffer
- 
-+  void addPixels(int a1, int black);
-+  void addPixelsNeg(int a1, int black);
-   short getTwoDimCode();
-   short getWhiteCode();
-   short getBlackCode();
diff --git a/kde-base/kpdf/kpdf-3.5.10-r1.ebuild b/kde-base/kpdf/kpdf-3.5.10-r1.ebuild
new file mode 100644
index 000000000000..08d605a1baba
--- /dev/null
+++ b/kde-base/kpdf/kpdf-3.5.10-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kpdf/kpdf-3.5.10-r1.ebuild,v 1.1 2009/05/29 15:44:30 tampakrap Exp $
+
+KMNAME=kdegraphics
+EAPI="1"
+inherit kde-meta flag-o-matic
+
+SRC_URI="${SRC_URI}
+	mirror://gentoo/${P}-JBIG2.tar.bz2"
+
+DESCRIPTION="kpdf, a kde pdf viewer based on xpdf"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE=""
+KMEXTRA="kfile-plugins/pdf"
+
+DEPEND=">=media-libs/freetype-2.3
+	media-libs/t1lib
+	>=virtual/poppler-qt3-0.6.1"
+RDEPEND="${DEPEND}
+	|| ( >=kde-base/kdeprint-${PV}:${SLOT} >=kde-base/kdebase-${PV}:${SLOT} )"
+
+PATCHES=( "${FILESDIR}/kde-CVE-2009-1188.patch"
+	"${WORKDIR}/${P}-JBIG2.patch"
+	"${FILESDIR}/${P}-font-hiding.patch" )
+
+src_compile() {
+	local myconf="--with-poppler"
+	replace-flags "-Os" "-O2" # see bug 114822
+
+	# Fix the desktop file.
+	sed -i -e "s:PDFViewer;:Viewer;:" "${S}/kpdf/shell/kpdf.desktop"
+
+	kde-meta_src_compile
+}