security fix for libxpdf, bug #196735

Package-Manager: portage-2.1.3.19

5 files changed, 677 insertions, 13 deletions

diff --git a/app-text/texlive-core/ChangeLog b/app-text/texlive-core/ChangeLog
index 9509001407fe..37961a2ee4c1 100644
--- a/app-text/texlive-core/ChangeLog
+++ b/app-text/texlive-core/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-text/texlive-core
 # Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/texlive-core/ChangeLog,v 1.24 2007/11/06 23:28:02 aballier Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/texlive-core/ChangeLog,v 1.25 2007/11/07 23:31:17 aballier Exp $
+
+*texlive-core-2007-r6 (07 Nov 2007)
+
+  07 Nov 2007; Alexis Ballier <aballier@gentoo.org>
+  +files/2007/xpdf-3.02pl2.patch, -texlive-core-2007-r5.ebuild,
+  +texlive-core-2007-r6.ebuild:
+  security fix for libxpdf, bug #196735
 
 *texlive-core-2007-r5 (06 Nov 2007)
 
diff --git a/app-text/texlive-core/Manifest b/app-text/texlive-core/Manifest
index d4c82fb85882..912f25bb5ad3 100644
--- a/app-text/texlive-core/Manifest
+++ b/app-text/texlive-core/Manifest
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX 2007/tetex-3.0-CVE-2007-0650.patch 2615 RMD160 3e3f55a17e35e3da3a6f77d62939ed66d8ae5222 SHA1 28208eb13f493c1c9c6538f254f04fc0c2aaff1e SHA256 9cb5525070bc4ea0685ac8a2f87df1dbbd2dcee4989e7b22c9897acfe6b67628
 MD5 8c2f3c2c87a5ec82869059df57af27c8 files/2007/tetex-3.0-CVE-2007-0650.patch 2615
 RMD160 3e3f55a17e35e3da3a6f77d62939ed66d8ae5222 files/2007/tetex-3.0-CVE-2007-0650.patch 2615
@@ -46,6 +49,10 @@ AUX 2007/texmf.d/25misc.cnf 3189 RMD160 934dab4267d66e5652eb4a5bf2f243affe6c751c
 MD5 f9b20a8646e199fa04410c2dc82cb171 files/2007/texmf.d/25misc.cnf 3189
 RMD160 934dab4267d66e5652eb4a5bf2f243affe6c751c files/2007/texmf.d/25misc.cnf 3189
 SHA256 9c70635fbb40c8a70d0f7c1531630e788d6b7da38bed1ee8396278849de953dc files/2007/texmf.d/25misc.cnf 3189
+AUX 2007/xpdf-3.02pl2.patch 16908 RMD160 bc1fd86527442f44ec5cfec754f2053b700a3dbf SHA1 620ec9fe4a4d63766b35bbeaa3261fd772e54a15 SHA256 a7e993257d8ad3b03f9d509973db141823496873c192ed4335ce66f744c468a6
+MD5 1f55d4489c7a8fa21b3e59e152b1514d files/2007/xpdf-3.02pl2.patch 16908
+RMD160 bc1fd86527442f44ec5cfec754f2053b700a3dbf files/2007/xpdf-3.02pl2.patch 16908
+SHA256 a7e993257d8ad3b03f9d509973db141823496873c192ed4335ce66f744c468a6 files/2007/xpdf-3.02pl2.patch 16908
 AUX texmf-update 2560 RMD160 5dfbf7738496e08305cc51375c1496ab74533a5b SHA1 8b4bda431b2696e3f5af0e781bb2bfc73641b739 SHA256 210f04e374c938e7fb3f08b8b70701f4911c21eca1ef0cd852b796a5cfaf2263
 MD5 aa4758afe15fd2366bc20795891db7a8 files/texmf-update 2560
 RMD160 5dfbf7738496e08305cc51375c1496ab74533a5b files/texmf-update 2560
@@ -102,18 +109,25 @@ DIST texlive-module-lib-regex-2007.zip 873 RMD160 1525034c3434b534a238b90730fe56
 DIST texlive-module-lib-zlib-2007.zip 1221 RMD160 c2dc6572cd09ef2494a8b299334b902df6567f4c SHA1 2c2a4814b2eaba74da4ae35521b521f83f688ab8 SHA256 9f9ab01c861946667c218e0e2ebea7bbb74a65e94ce9cb699b99cfd51fbcfd5a
 DIST texlive-module-mft-2007.zip 9083 RMD160 a07d22432636f38a7639a5385ed3e96626041e45 SHA1 fc5585b86daf583779dacc9e25d0e615ba6519e4 SHA256 6d4a52492a03b41fdfc50532a9061ad94723c67ec5ded1d0ea549ee4978511a4
 DIST texlive-module-mkind-english-2007.zip 2264 RMD160 c2d9e9164ed10f55bda56247e94d9bf63adf93e6 SHA1 6660cefd619df95f80f63146f0501cc8dc02e344 SHA256 333fb0b1b4b12764fb16a93ced43721a781202cf0fcb71c5eed4a4903dca5d5c
-EBUILD texlive-core-2007-r5.ebuild 7967 RMD160 8025ffe415ab894ffcbeb6ab605e047a7a5c9a59 SHA1 377ddd0e9250aca966402e9a3938032f9d0e912c SHA256 8acc9678deb27acee582ecc5046b619aed3a4497c833932a96762210ac1a73af
-MD5 c75ac8da71c1e9d9cdc2566c53fe7abc texlive-core-2007-r5.ebuild 7967
-RMD160 8025ffe415ab894ffcbeb6ab605e047a7a5c9a59 texlive-core-2007-r5.ebuild 7967
-SHA256 8acc9678deb27acee582ecc5046b619aed3a4497c833932a96762210ac1a73af texlive-core-2007-r5.ebuild 7967
-MISC ChangeLog 4876 RMD160 6833ab23a8fcbede224b3a7912a1783446ec17bd SHA1 b6bd812c474c78a77a1e2541ea16f6e1aadb33b6 SHA256 cead16f937b8ac43ee5bd5e3d28468409d12f50909635071c87f132289260c43
-MD5 654d88acdb83688d29aeb8feb088c2c4 ChangeLog 4876
-RMD160 6833ab23a8fcbede224b3a7912a1783446ec17bd ChangeLog 4876
-SHA256 cead16f937b8ac43ee5bd5e3d28468409d12f50909635071c87f132289260c43 ChangeLog 4876
+EBUILD texlive-core-2007-r6.ebuild 8037 RMD160 e0e2c9ee81cff54b24c1529a86ee41b0cb82e54a SHA1 c1bf9915ef1ccfb277fb87ceedf5cf9cf707f0e4 SHA256 3391da60c8c6fa32d56f4e576d489e7a1893f2ad21e98352c4f39a3e7a015803
+MD5 26f7d4be6320fc70d7313d4203a09e56 texlive-core-2007-r6.ebuild 8037
+RMD160 e0e2c9ee81cff54b24c1529a86ee41b0cb82e54a texlive-core-2007-r6.ebuild 8037
+SHA256 3391da60c8c6fa32d56f4e576d489e7a1893f2ad21e98352c4f39a3e7a015803 texlive-core-2007-r6.ebuild 8037
+MISC ChangeLog 5102 RMD160 136c0c3fb1fda66783160e36e2f71d4174cf8e76 SHA1 ddd82e15c4b0c6b6e52cf0555c1097fcbe420c5b SHA256 ee4f4c07a2710d3c51fd87420103e4490fcf1cf5a40c233994510a48bf40da33
+MD5 0a352deea7a3cf1de8e704214d4dabcd ChangeLog 5102
+RMD160 136c0c3fb1fda66783160e36e2f71d4174cf8e76 ChangeLog 5102
+SHA256 ee4f4c07a2710d3c51fd87420103e4490fcf1cf5a40c233994510a48bf40da33 ChangeLog 5102
 MISC metadata.xml 327 RMD160 10186cf048d44753bf4cec722eed45d2ade12316 SHA1 0254321c012da0e8f80aec6f29a0fb5b17675d4d SHA256 e520223493249c261b48f7f7460ed7c262d35383484e730cfefba51fde1195be
 MD5 10ddcc0c6d2a7a76dd92dffa01ca03ca metadata.xml 327
 RMD160 10186cf048d44753bf4cec722eed45d2ade12316 metadata.xml 327
 SHA256 e520223493249c261b48f7f7460ed7c262d35383484e730cfefba51fde1195be metadata.xml 327
-MD5 2b2f5a687b4ee3c791b2f7a1897807fd files/digest-texlive-core-2007-r5 14527
-RMD160 2e8c8f55370fd2635c596d09aba8032690cb3c3e files/digest-texlive-core-2007-r5 14527
-SHA256 eeafa2cdaa1b7fa1142295b4eb8ece4941ab7e544539baa43416569d8cd7d53b files/digest-texlive-core-2007-r5 14527
+MD5 2b2f5a687b4ee3c791b2f7a1897807fd files/digest-texlive-core-2007-r6 14527
+RMD160 2e8c8f55370fd2635c596d09aba8032690cb3c3e files/digest-texlive-core-2007-r6 14527
+SHA256 eeafa2cdaa1b7fa1142295b4eb8ece4941ab7e544539baa43416569d8cd7d53b files/digest-texlive-core-2007-r6 14527
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.7 (GNU/Linux)
+
+iD8DBQFHMkrsvFcC4BYPU0oRAsXAAJ4msHh6qE2mhNiSVSZD0I4Zww9sigCfW9oG
+4vB0OPKvQ0OFAYHHNbj0AvA=
+=tpIT
+-----END PGP SIGNATURE-----
diff --git a/app-text/texlive-core/files/2007/xpdf-3.02pl2.patch b/app-text/texlive-core/files/2007/xpdf-3.02pl2.patch
new file mode 100644
index 000000000000..1d962f328a02
--- /dev/null
+++ b/app-text/texlive-core/files/2007/xpdf-3.02pl2.patch
@@ -0,0 +1,640 @@
+Index: tetex-src-3.0/libs/xpdf/xpdf/Stream.cc
+===================================================================
+--- tetex-src-3.0.orig/libs/xpdf/xpdf/Stream.cc
++++ tetex-src-3.0/libs/xpdf/xpdf/Stream.cc
+@@ -1285,19 +1285,24 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+     error (-1, "invalid number of columns: %d\n", columns);
+     exit (1);
+   }
++  else if (columns > INT_MAX - 2) columns = INT_MAX - 2;
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+-  refLine = (short *)gmallocn(columns + 4, sizeof(short));
+-  codingLine = (short *)gmallocn(columns + 3, sizeof(short));
++  // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
++  // ---> max codingLine size = columns + 1
++  // refLine has one extra guard entry at the end
++  // ---> max refLine size = columns + 2
++  codingLine = (int *)gmallocn(columns + 1, sizeof(int));
++  refLine = (int *)gmallocn(columns + 2, sizeof(int));
+ 
+   eof = gFalse;
+   row = 0;
+   nextLine2D = encoding < 0;
+   inputBits = 0;
+-  codingLine[0] = 0;
+-  codingLine[1] = refLine[2] = columns;
+-  a0 = 1;
++  codingLine[0] = columns;
++  a0i = 0;
++  outputBits = 0;
+ 
+   buf = EOF;
+ }
+@@ -1316,9 +1321,9 @@ void CCITTFaxStream::reset() {
+   row = 0;
+   nextLine2D = encoding < 0;
+   inputBits = 0;
+-  codingLine[0] = 0;
+-  codingLine[1] = refLine[2] = columns;
+-  a0 = 1;
++  codingLine[0] = columns;
++  a0i = 0;
++  outputBits = 0;
+   buf = EOF;
+ 
+   // skip any initial zero bits and end-of-line marker, and get the 2D
+@@ -1335,164 +1340,228 @@ void CCITTFaxStream::reset() {
+   }
+ }
+ 
++inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
++  if (a1 > codingLine[a0i]) {
++    if (a1 > columns) {
++      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
++      err = gTrue;
++      a1 = columns;
++    }
++    if ((a0i & 1) ^ blackPixels) {
++      ++a0i;
++    }
++    codingLine[a0i] = a1;
++  }
++}
++
++inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
++  if (a1 > codingLine[a0i]) {
++    if (a1 > columns) {
++      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
++      err = gTrue;
++      a1 = columns;
++    }
++    if ((a0i & 1) ^ blackPixels) {
++      ++a0i;
++    }
++    codingLine[a0i] = a1;
++  } else if (a1 < codingLine[a0i]) {
++    if (a1 < 0) {
++      error(getPos(), "Invalid CCITTFax code");
++      err = gTrue;
++      a1 = 0;
++    }
++    while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
++      --a0i;
++    }
++    codingLine[a0i] = a1;
++  }
++}
++ 
+ int CCITTFaxStream::lookChar() {
+   short code1, code2, code3;
+-  int a0New;
+-  GBool err, gotEOL;
+-  int ret;
+-  int bits, i;
+-
+-  // if at eof just return EOF
+-  if (eof && codingLine[a0] >= columns) {
+-    return EOF;
++  int b1i, blackPixels, i, bits;
++  GBool gotEOL;
++  
++  if (buf != EOF) {
++    return buf;
+   }
+ 
+   // read the next row
+-  err = gFalse;
+-  if (codingLine[a0] >= columns) {
++  if (outputBits == 0) {
+ 
++    // if at eof just return EOF
++    if (eof) {
++      return EOF;
++    }
++
++    err = gFalse;
++  
+     // 2-D encoding
+     if (nextLine2D) {
+       for (i = 0; codingLine[i] < columns; ++i)
+ 	refLine[i] = codingLine[i];
+-      refLine[i] = refLine[i + 1] = columns;
+-      b1 = 1;
+-      a0New = codingLine[a0 = 0] = 0;
+-      do {
+-	code1 = getTwoDimCode();
++      refLine[i++] = columns;
++      refLine[i] = columns;
++      codingLine[0] = 0;
++      a0i = 0;
++      b1i = 0;
++      blackPixels = 0;
++      // invariant:
++      // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
++      //                                                             <= columns
++      // exception at left edge:
++      //   codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
++      // exception at right edge:
++      //   refLine[b1i] = refLine[b1i+1] = columns is possible
++      while (codingLine[a0i] < columns) {
++  	code1 = getTwoDimCode();
+ 	switch (code1) {
+-	case twoDimPass:
+-	  if (refLine[b1] < columns) {
+-	    a0New = refLine[b1 + 1];
+-	    b1 += 2;
+-	  }
+-	  break;
+-	case twoDimHoriz:
+-	  if ((a0 & 1) == 0) {
+-	    code1 = code2 = 0;
+-	    do {
+-	      code1 += code3 = getWhiteCode();
+-	    } while (code3 >= 64);
+-	    do {
+-	      code2 += code3 = getBlackCode();
+-	    } while (code3 >= 64);
+-	  } else {
+-	    code1 = code2 = 0;
+-	    do {
+-	      code1 += code3 = getBlackCode();
+-	    } while (code3 >= 64);
+-	    do {
+-	      code2 += code3 = getWhiteCode();
+-	    } while (code3 >= 64);
+-	  }
+-	  if (code1 > 0 || code2 > 0) {
+-	    codingLine[a0 + 1] = a0New + code1;
+-	    ++a0;
+-	    a0New = codingLine[a0 + 1] = codingLine[a0] + code2;
+-	    ++a0;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVert0:
+-	  a0New = codingLine[++a0] = refLine[b1];
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVertR1:
+-	  a0New = codingLine[++a0] = refLine[b1] + 1;
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVertL1:
+-	  if (a0 == 0 || refLine[b1] - 1 > a0New) {
+-	    a0New = codingLine[++a0] = refLine[b1] - 1;
+-	    --b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVertR2:
+-	  a0New = codingLine[++a0] = refLine[b1] + 2;
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVertL2:
+-	  if (a0 == 0 || refLine[b1] - 2 > a0New) {
+-	    a0New = codingLine[++a0] = refLine[b1] - 2;
+-	    --b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVertR3:
+-	  a0New = codingLine[++a0] = refLine[b1] + 3;
+-	  if (refLine[b1] < columns) {
+-	    ++b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case twoDimVertL3:
+-	  if (a0 == 0 || refLine[b1] - 3 > a0New) {
+-	    a0New = codingLine[++a0] = refLine[b1] - 3;
+-	    --b1;
+-	    while (refLine[b1] <= codingLine[a0] && refLine[b1] < columns)
+-	      b1 += 2;
+-	  }
+-	  break;
+-	case EOF:
+-	  eof = gTrue;
+-	  codingLine[a0 = 0] = columns;
+-	  return EOF;
+-	default:
+-	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
+-	  err = gTrue;
+-	  break;
++  	case twoDimPass:
++ 	  addPixels(refLine[b1i + 1], blackPixels);
++ 	  if (refLine[b1i + 1] < columns) {
++ 	    b1i += 2;
++  	  }
++  	  break;
++  	case twoDimHoriz:
++ 	  code1 = code2 = 0;
++ 	  if (blackPixels) {
++  	    do {
++ 	      code1 += code3 = getBlackCode();
++  	    } while (code3 >= 64);
++  	    do {
++ 	      code2 += code3 = getWhiteCode();
++  	    } while (code3 >= 64);
++  	  } else {
++  	    do {
++ 	      code1 += code3 = getWhiteCode();
++  	    } while (code3 >= 64);
++  	    do {
++ 	      code2 += code3 = getBlackCode();
++  	    } while (code3 >= 64);
++  	  }
++ 	  addPixels(codingLine[a0i] + code1, blackPixels);
++ 	  if (codingLine[a0i] < columns) {
++ 	    addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
++ 	  }
++ 	  while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	    b1i += 2;
++ 	  }
++ 	  break;
++ 	case twoDimVertR3:
++ 	  addPixels(refLine[b1i] + 3, blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    ++b1i;
++ 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++  	    }
++  	  }
++  	  break;
++ 	case twoDimVertR2:
++ 	  addPixels(refLine[b1i] + 2, blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    ++b1i;
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++  	    }
++  	  }
++  	  break;
++  	case twoDimVertR1:
++ 	  addPixels(refLine[b1i] + 1, blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    ++b1i;
++ 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++  	    }
++  	  }
++  	  break;
++ 	case twoDimVert0:
++ 	  addPixels(refLine[b1i], blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    ++b1i;
++ 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++  	    }
++  	  }
++  	  break;
++ 	case twoDimVertL3:
++ 	  addPixelsNeg(refLine[b1i] - 3, blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    if (b1i > 0) {
++ 	      --b1i;
++ 	    } else {
++	      ++b1i;
++ 	    }
++	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++  	    }
++  	  }
++  	  break;
++  	case twoDimVertL2:
++ 	  addPixelsNeg(refLine[b1i] - 2, blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    if (b1i > 0) {
++ 	      --b1i;
++ 	    } else {
++ 	      ++b1i;
++  	    }
++ 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++ 	    }
++  	  }
++  	  break;
++ 	case twoDimVertL1:
++ 	  addPixelsNeg(refLine[b1i] - 1, blackPixels);
++ 	  blackPixels ^= 1;
++ 	  if (codingLine[a0i] < columns) {
++ 	    if (b1i > 0) {
++ 	      --b1i;
++ 	    } else {
++ 	      ++b1i;
++ 	    }
++ 	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
++ 	      b1i += 2;
++  	    }
++  	  }
++  	  break;
++  	case EOF:
++ 	  addPixels(columns, 0);
++  	  eof = gTrue;
++ 	  break;
++  	default:
++  	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
++ 	  addPixels(columns, 0);
++  	  err = gTrue;
++  	  break;
++  	}
+ 	}
+-      } while (codingLine[a0] < columns);
+ 
+     // 1-D encoding
+     } else {
+-      codingLine[a0 = 0] = 0;
+-      while (1) {
+-	code1 = 0;
+-	do {
+-	  code1 += code3 = getWhiteCode();
+-	} while (code3 >= 64);
+-	codingLine[a0+1] = codingLine[a0] + code1;
+-	++a0;
+-	if (codingLine[a0] >= columns)
+-	  break;
+-	code2 = 0;
+-	do {
+-	  code2 += code3 = getBlackCode();
+-	} while (code3 >= 64);
+-	codingLine[a0+1] = codingLine[a0] + code2;
+-	++a0;
+-	if (codingLine[a0] >= columns)
+-	  break;
+-      }
+-    }
+-
+-    if (codingLine[a0] != columns) {
+-      error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
+-      // force the row to be the correct length
+-      while (codingLine[a0] > columns) {
+-	--a0;
++       codingLine[0] = 0;
++       a0i = 0;
++       blackPixels = 0;
++       while (codingLine[a0i] < columns) {
++ 	code1 = 0;
++ 	if (blackPixels) {
++ 	  do {
++ 	    code1 += code3 = getBlackCode();
++ 	  } while (code3 >= 64);
++ 	} else {
++ 	  do {
++ 	    code1 += code3 = getWhiteCode();
++ 	  } while (code3 >= 64);
++  	}
++ 	addPixels(codingLine[a0i] + code1, blackPixels);
++ 	blackPixels ^= 1;
++        }
+       }
+-      codingLine[++a0] = columns;
+-      err = gTrue;
+-    }
+ 
+     // byte-align the row
+     if (byteAlign) {
+@@ -1552,14 +1621,17 @@ int CCITTFaxStream::lookChar() {
+     // this if we know the stream contains end-of-line markers because
+     // the "just plow on" technique tends to work better otherwise
+     } else if (err && endOfLine) {
+-      do {
++      while (1) {
++	code1 = lookBits(13);
+ 	if (code1 == EOF) {
+ 	  eof = gTrue;
+ 	  return EOF;
+ 	}
++	if ((code1 >> 1) == 0x001) {
++	  break;
++	}
+ 	eatBits(1);
+-	code1 = lookBits(13);
+-      } while ((code1 >> 1) != 0x001);
++      }
+       eatBits(12); 
+       if (encoding > 0) {
+ 	eatBits(1);
+@@ -1567,11 +1639,11 @@ int CCITTFaxStream::lookChar() {
+       }
+     }
+ 
+-    a0 = 0;
+-    outputBits = codingLine[1] - codingLine[0];
+-    if (outputBits == 0) {
+-      a0 = 1;
+-      outputBits = codingLine[2] - codingLine[1];
++    // set up for output
++    if (codingLine[0] > 0) {
++      outputBits = codingLine[a0i = 0];
++    } else {
++      outputBits = codingLine[a0i = 1];
+     }
+ 
+     ++row;
+@@ -1579,39 +1651,43 @@ int CCITTFaxStream::lookChar() {
+ 
+   // get a byte
+   if (outputBits >= 8) {
+-    ret = ((a0 & 1) == 0) ? 0xff : 0x00;
+-    if ((outputBits -= 8) == 0) {
+-      ++a0;
+-      if (codingLine[a0] < columns) {
+-	outputBits = codingLine[a0 + 1] - codingLine[a0];
+-      }
++    buf = (a0i & 1) ? 0x00 : 0xff;
++    outputBits -= 8;
++    if (outputBits == 0 && codingLine[a0i] < columns) {
++      ++a0i;
++      outputBits = codingLine[a0i] - codingLine[a0i - 1];
+     }
+   } else {
+     bits = 8;
+-    ret = 0;
++    buf = 0;
+     do {
+       if (outputBits > bits) {
+-	i = bits;
+-	bits = 0;
+-	if ((a0 & 1) == 0) {
+-	  ret |= 0xff >> (8 - i);
++	buf <<= bits;
++	if (!(a0i & 1)) {
++	  buf |= 0xff >> (8 - bits);
+ 	}
+-	outputBits -= i;
++	outputBits -= bits;
++	bits = 0;
+       } else {
+-	i = outputBits;
+-	bits -= outputBits;
+-	if ((a0 & 1) == 0) {
+-	  ret |= (0xff >> (8 - i)) << bits;
++	buf <<= outputBits;
++	if (!(a0i & 1)) {
++	  buf |= 0xff >> (8 - outputBits);
+ 	}
++	bits -= outputBits;
+ 	outputBits = 0;
+-	++a0;
+-	if (codingLine[a0] < columns) {
+-	  outputBits = codingLine[a0 + 1] - codingLine[a0];
++	if (codingLine[a0i] < columns) {
++	  ++a0i;
++	  outputBits = codingLine[a0i] - codingLine[a0i - 1];
++	} else if (bits > 0) {
++	  buf <<= bits;
++	  bits = 0;
+ 	}
+       }
+-    } while (bits > 0 && codingLine[a0] < columns);
++    } while (bits);
++  }
++  if (black) {
++    buf ^= 0xff;
+   }
+-  buf = black ? (ret ^ 0xff) : ret;
+   return buf;
+ }
+ 
+@@ -1653,6 +1729,9 @@ short CCITTFaxStream::getWhiteCode() {
+   code = 0; // make gcc happy
+   if (endOfBlock) {
+     code = lookBits(12);
++    if (code == EOF) {
++      return 1;
++    }
+     if ((code >> 5) == 0) {
+       p = &whiteTab1[code];
+     } else {
+@@ -1665,6 +1744,9 @@ short CCITTFaxStream::getWhiteCode() {
+   } else {
+     for (n = 1; n <= 9; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 9) {
+ 	code <<= 9 - n;
+       }
+@@ -1676,6 +1758,9 @@ short CCITTFaxStream::getWhiteCode() {
+     }
+     for (n = 11; n <= 12; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 12) {
+ 	code <<= 12 - n;
+       }
+@@ -1701,6 +1786,9 @@ short CCITTFaxStream::getBlackCode() {
+   code = 0; // make gcc happy
+   if (endOfBlock) {
+     code = lookBits(13);
++    if (code == EOF) {
++      return 1;
++    }
+     if ((code >> 7) == 0) {
+       p = &blackTab1[code];
+     } else if ((code >> 9) == 0) {
+@@ -1715,6 +1803,9 @@ short CCITTFaxStream::getBlackCode() {
+   } else {
+     for (n = 2; n <= 6; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 6) {
+ 	code <<= 6 - n;
+       }
+@@ -1726,6 +1817,9 @@ short CCITTFaxStream::getBlackCode() {
+     }
+     for (n = 7; n <= 12; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 12) {
+ 	code <<= 12 - n;
+       }
+@@ -1739,6 +1833,9 @@ short CCITTFaxStream::getBlackCode() {
+     }
+     for (n = 10; n <= 13; ++n) {
+       code = lookBits(n);
++      if (code == EOF) {
++	return 1;
++      }
+       if (n < 13) {
+ 	code <<= 13 - n;
+       }
+@@ -1961,6 +2058,12 @@ void DCTStream::reset() {
+     // allocate a buffer for the whole image
+     bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
+     bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
++    if (bufWidth <= 0 || bufHeight <= 0 ||
++	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
++      error(getPos(), "Invalid image size in DCT stream");
++      y = height;
++      return;
++    }
+     for (i = 0; i < numComps; ++i) {
+       frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
+       memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
+@@ -3024,6 +3127,11 @@ GBool DCTStream::readScanInfo() {
+   }
+   scanInfo.firstCoeff = str->getChar();
+   scanInfo.lastCoeff = str->getChar();
++  if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
++      scanInfo.firstCoeff > scanInfo.lastCoeff) {
++    error(getPos(), "Bad DCT coefficient numbers in scan info block");
++    return gFalse;
++  }
+   c = str->getChar();
+   scanInfo.ah = (c >> 4) & 0x0f;
+   scanInfo.al = c & 0x0f;
+Index: tetex-src-3.0/libs/xpdf/xpdf/Stream.h
+===================================================================
+--- tetex-src-3.0.orig/libs/xpdf/xpdf/Stream.h
++++ tetex-src-3.0/libs/xpdf/xpdf/Stream.h
+@@ -519,13 +519,15 @@ private:
+   int row;			// current row
+   int inputBuf;			// input buffer
+   int inputBits;		// number of bits in input buffer
+-  short *refLine;		// reference line changing elements
+-  int b1;			// index into refLine
+-  short *codingLine;		// coding line changing elements
+-  int a0;			// index into codingLine
++  int *codingLine;		// coding line changing elements
++  int *refLine;			// reference line changing elements
++  int a0i;			// index into codingLine
++  GBool err;			// error on current line
+   int outputBits;		// remaining ouput bits
+   int buf;			// character buffer
+ 
++  void addPixels(int a1, int black);
++  void addPixelsNeg(int a1, int black);
+   short getTwoDimCode();
+   short getWhiteCode();
+   short getBlackCode();
diff --git a/app-text/texlive-core/files/digest-texlive-core-2007-r5 b/app-text/texlive-core/files/digest-texlive-core-2007-r6
index 5c20835cdcb8..5c20835cdcb8 100644
--- a/app-text/texlive-core/files/digest-texlive-core-2007-r5
+++ b/app-text/texlive-core/files/digest-texlive-core-2007-r6
diff --git a/app-text/texlive-core/texlive-core-2007-r5.ebuild b/app-text/texlive-core/texlive-core-2007-r6.ebuild
index 68049cb22688..090d8557c604 100644
--- a/app-text/texlive-core/texlive-core-2007-r5.ebuild
+++ b/app-text/texlive-core/texlive-core-2007-r6.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2007 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/texlive-core/texlive-core-2007-r5.ebuild,v 1.2 2007/11/07 19:29:26 mr_bones_ Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/texlive-core/texlive-core-2007-r6.ebuild,v 1.1 2007/11/07 23:31:17 aballier Exp $
 
 inherit eutils flag-o-matic toolchain-funcs libtool autotools texlive-common
 
@@ -87,6 +87,9 @@ src_unpack() {
 # dviljk buffer overflow issues, bug #198229
 	epatch "${WORKDIR}/${P}-dviljk-security-fixes.patch"
 
+# security bug #196735
+	epatch "${FILESDIR}/${PV}/xpdf-3.02pl2.patch"
+
 	sed -i -e "/mktexlsr/,+3d" -e "s/\(updmap-sys\)/\1 --nohash/" \
 		Makefile.in || die "sed failed"