Description: fix multiple code execution issues
Origin: backported from 1.0.47 release

diff -Naurp cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPSplash.cxx cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPSplash.cxx
--- cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPSplash.cxx	2013-12-10 16:20:15.000000000 -0500
+++ cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPSplash.cxx	2014-03-10 07:19:19.000000000 -0400
@@ -1094,7 +1094,7 @@ void OPVPSplash::fillGlyph(SplashCoord x
     
     opvpbytes = (m+3)/4;
     opvpbytes *= 4;
-    bp = (Guchar *)gmalloc(opvpbytes*glyph->h);
+    bp = (Guchar *)gmallocn(glyph->h,opvpbytes);
     for (i = 0;i < glyph->h;i++) {
       memcpy(bp+i*opvpbytes,glyph->data+i*m,m);
     }
@@ -1238,8 +1238,8 @@ SplashError OPVPSplash::fillImageMaskFas
   /* align 4 */
   opvpbytes = (opvpbytes+3)/4;
   opvpbytes *= 4;
-  buf = (Guchar *)gmalloc(opvpbytes*h);
-  lineBuf = (SplashColorPtr)gmalloc(opvpbytes*8);
+  buf = (Guchar *)gmallocn(h,opvpbytes);
+  lineBuf = (SplashColorPtr)gmallocn(8,opvpbytes);
 
   for (i = 0;i < h;i++) {
     int k;
@@ -1417,7 +1417,7 @@ SplashError OPVPSplash::fillImageMask(Sp
   imat[3] = mat[0]/det;
 
   /* read source image */
-  pixBuf = (SplashColorPtr)gmalloc(h * w);
+  pixBuf = (SplashColorPtr)gmallocn(h , w);
 
   p = pixBuf;
   for (i = 0; i < h; ++i) {
@@ -1571,8 +1571,8 @@ SplashError OPVPSplash::drawImageNotShea
     hs = h-1;
     he = -1;
   }
-  buf = (Guchar *)gmalloc(opvpbytes*h);
-  lineBuf = (SplashColorPtr)gmalloc(lineBufSize);
+  buf = (Guchar *)gmallocn(h,opvpbytes);
+  lineBuf = (SplashColorPtr)gmallocn(lineBufSize,1);
   switch (colorMode) {
   case splashModeMono1:
   case splashModeMono8:
@@ -1734,7 +1734,7 @@ SplashError OPVPSplash::drawImageFastWit
     return splashErrOPVP;
     break;
   }
-  buf = (Guchar *)gmalloc(opvpbytes*h);
+  buf = (Guchar *)gmallocn(h,opvpbytes);
 
   switch (colorMode) {
   case splashModeMono1:
@@ -1960,7 +1960,7 @@ SplashError OPVPSplash::drawImage(Splash
   }
 
   /* read source image */
-  pixBuf = (SplashColorPtr)gmalloc(h * linesize);
+  pixBuf = (SplashColorPtr)gmallocn(h , linesize);
 
   p = pixBuf;
   for (i = 0; i < h; ++i) {
@@ -1968,8 +1968,8 @@ SplashError OPVPSplash::drawImage(Splash
     p += linesize;
   }
   /* allocate line buffer */
-  Guchar *lineBuf = (Guchar *)gmalloc(opvpbytes);
-  Guchar *onBuf = (Guchar *)gmalloc(width);
+  Guchar *lineBuf = (Guchar *)gmallocn(opvpbytes,1);
+  Guchar *onBuf = (Guchar *)gmallocn(width,1);
   OPVPSplashClip *clip;
   opvpctm.a = 1.0;
   opvpctm.b = 0.0;
diff -Naurp cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPWrapper.cxx cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPWrapper.cxx
--- cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPWrapper.cxx	2013-12-10 16:20:15.000000000 -0500
+++ cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPWrapper.cxx	2014-03-10 07:19:19.000000000 -0400
@@ -822,6 +822,12 @@ OPVPWrapper *OPVPWrapper::loadDriver(con
     void *handle = 0;
     OPVPWrapper *opvp = 0;
 
+    // remove directory part
+    const char *s = strrchr(driverName,'/');
+    if (s != NULL) {
+        driverName = s+1;
+    }
+
     list = genDynamicLibName(driverName);
 
     if (list) {
diff -Naurp cups-filters-1.0.46/filter/pdftoopvp/OPVPOutputDev.cxx cups-filters-1.0.47/filter/pdftoopvp/OPVPOutputDev.cxx
--- cups-filters-1.0.46/filter/pdftoopvp/OPVPOutputDev.cxx	2013-12-10 16:20:15.000000000 -0500
+++ cups-filters-1.0.47/filter/pdftoopvp/OPVPOutputDev.cxx	2014-03-10 07:19:19.000000000 -0400
@@ -147,8 +147,8 @@ T3FontCache::T3FontCache(Ref *fontIDA, d
   } else {
     cacheSets = 1;
   }
-  cacheData = (Guchar *)gmalloc(cacheSets * cacheAssoc * glyphSize);
-  cacheTags = (T3FontCacheTag *)gmalloc(cacheSets * cacheAssoc *
+  cacheData = (Guchar *)gmallocn3(cacheSets , cacheAssoc , glyphSize);
+  cacheTags = (T3FontCacheTag *)gmallocn3(cacheSets , cacheAssoc ,
 					sizeof(T3FontCacheTag));
   for (i = 0; i < cacheSets * cacheAssoc; ++i) {
     cacheTags[i].mru = i & (cacheAssoc - 1);
@@ -1416,7 +1416,7 @@ void OPVPOutputDev::drawImage(GfxState *
     switch (colorMode) {
     case splashModeMono1:
     case splashModeMono8:
-      imgData.lookup = (SplashColorPtr)gmalloc(n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,1);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getGray(&pix, &gray);
@@ -1424,7 +1424,7 @@ void OPVPOutputDev::drawImage(GfxState *
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1434,7 +1434,7 @@ void OPVPOutputDev::drawImage(GfxState *
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1445,7 +1445,7 @@ void OPVPOutputDev::drawImage(GfxState *
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,4);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
@@ -1672,7 +1672,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
     switch (colorMode) {
     case splashModeMono1:
     case splashModeMono8:
-      imgData.lookup = (SplashColorPtr)gmalloc(n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,1);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getGray(&pix, &gray);
@@ -1680,7 +1680,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1690,7 +1690,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1701,7 +1701,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,4);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
@@ -1793,7 +1793,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
   imgMaskData.height = maskHeight;
   imgMaskData.y = 0;
   n = 1 << maskColorMap->getBits();
-  imgMaskData.lookup = (SplashColorPtr)gmalloc(n);
+  imgMaskData.lookup = (SplashColorPtr)gmallocn(n,1);
   for (i = 0; i < n; ++i) {
     pix = (Guchar)i;
     maskColorMap->getGray(&pix, &gray);
@@ -1839,7 +1839,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
     switch (colorMode) {
     case splashModeMono1:
     case splashModeMono8:
-      imgData.lookup = (SplashColorPtr)gmalloc(n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,1);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getGray(&pix, &gray);
@@ -1847,7 +1847,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1857,7 +1857,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1868,7 +1868,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,4);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
diff -Naurp cups-filters-1.0.46/filter/urftopdf.cpp cups-filters-1.0.47/filter/urftopdf.cpp
--- cups-filters-1.0.46/filter/urftopdf.cpp	2013-12-10 16:20:15.000000000 -0500
+++ cups-filters-1.0.47/filter/urftopdf.cpp	2014-03-10 07:15:01.000000000 -0400
@@ -26,6 +26,7 @@
 #include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits>
 
 #include <arpa/inet.h>   // ntohl
 
@@ -194,6 +195,9 @@ int add_pdf_page(struct pdf_info * info,
         info->line_bytes = (width*info->pixel_bytes);
         info->bpp = bpp;
     
+        if (info->height > (std::numeric_limits<unsigned>::max() / info->line_bytes)) {
+            die("Page too big");
+        }
         info->page_data = PointerHolder<Buffer>(new Buffer(info->line_bytes*info->height));
 
         QPDFObjectHandle page = QPDFObjectHandle::parse(
@@ -283,6 +287,9 @@ int decode_raster(int fd, unsigned width
     std::vector<uint8_t> pixel_container;
     std::vector<uint8_t> line_container;
 
+    if (width > (std::numeric_limits<unsigned>::max() / pixel_size)) {
+        die("Line too big");
+    }
     try {
         pixel_container.resize(pixel_size);
         line_container.resize(pixel_size*width);
