2 files changed, 64 insertions, 0 deletions
diff --git a/kde-base/kpdf/files/digest-kpdf-3.4.1-r1 b/kde-base/kpdf/files/digest-kpdf-3.4.1-r1
new file mode 100644
index 000000000000..5cce6072f68f
--- /dev/null
+++ b/kde-base/kpdf/files/digest-kpdf-3.4.1-r1
@@ -0,0 +1,3 @@
+MD5 5a0a32e314422e2ce051290c08390367 kdegraphics-3.4.0.tar.bz2 6667685
+MD5 233069e4d1846e828ac2385167cf38b1 kdegraphics-3.4.0-3.4.1.tar.xdelta 292428
+MD5 d91ef530a416bd8407abb28103bc049c kdegraphics-3.4.1.tar.bz2 6581563
diff --git a/kde-base/kpdf/files/post-3.4.1-kdegraphics-4.diff b/kde-base/kpdf/files/post-3.4.1-kdegraphics-4.diff
new file mode 100644
index 000000000000..98f949944847
--- /dev/null
+++ b/kde-base/kpdf/files/post-3.4.1-kdegraphics-4.diff
@@ -0,0 +1,61 @@
+Index: kpdf/xpdf/xpdf/SplashOutputDev.cc
+===================================================================
+--- kpdf/xpdf/xpdf/SplashOutputDev.cc	(revision 439200)
++++ kpdf/xpdf/xpdf/SplashOutputDev.cc	(working copy)
+@@ -621,16 +621,19 @@
+       }
+       break;
+     case fontTrueType:
+-      if (!(ff = FoFiTrueType::load(fileName->getCString()))) {
+-	goto err2;
++      if ((ff = FoFiTrueType::load(fileName->getCString()))) {
++	codeToGID = ((Gfx8BitFont *)gfxFont)->getCodeToGIDMap(ff);
++	n = 256;
++	delete ff;
++      } else {
++	codeToGID = NULL;
++	n = 0;
+       }
+-      codeToGID = ((Gfx8BitFont *)gfxFont)->getCodeToGIDMap(ff);
+-      delete ff;
+       if (!(fontFile = fontEngine->loadTrueTypeFont(
+ 			   id,
+ 			   fileName->getCString(),
+ 			   fileName == tmpFileName,
+-			   codeToGID, 256))) {
++			   codeToGID, n))) {
+ 	error(-1, "Couldn't create a font for '%s'",
+ 	      gfxFont->getName() ? gfxFont->getName()->getCString()
+ 	                         : "(unnamed)");
+Index: kpdf/xpdf/fofi/FoFiTrueType.cc
+===================================================================
+--- kpdf/xpdf/fofi/FoFiTrueType.cc	(revision 439200)
++++ kpdf/xpdf/fofi/FoFiTrueType.cc	(working copy)
+@@ -1343,6 +1343,27 @@
+     return;
+   }
+ 
++  // make sure the loca table is sane (correct length and entries are
++  // in bounds)
++  i = seekTable("loca");
++  if (tables[i].len < (nGlyphs + 1) * (locaFmt ? 4 : 2)) {
++    parsedOk = gFalse;
++    return;
++  }
++  for (j = 0; j <= nGlyphs; ++j) {
++    if (locaFmt) {
++      pos = (int)getU32BE(tables[i].offset + j*4, &parsedOk);
++    } else {
++      pos = getU16BE(tables[i].offset + j*2, &parsedOk);
++    }
++    if (pos < 0 || pos > len) {
++      parsedOk = gFalse;
++    }
++  }
++  if (!parsedOk) {
++    return;
++  }
++
+   // read the post table
+   readPostTable();
+   if (!parsedOk) {