backends: Fix several security issues in the dvi-backend.

[evince.git] / backend / dvi / mdvi-lib / dviread.c

diff --git a/backend/dvi/mdvi-lib/dviread.c b/backend/dvi/mdvi-lib/dviread.c
index 97b7b844103f961364ad32685e0a6a89091be020..d01432056518ac6ae3518ed3eec5f5705159f02f 100644 (file)
--- a/backend/dvi/mdvi-lib/dviread.c
+++ b/backend/dvi/mdvi-lib/dviread.c
@@ -1166,43 +1166,13 @@ static void inline fix_after_horizontal(DviContext *dvi)
        (a), (b) > 0 ? '+' : '-', \
        (b) > 0 ? (b) : -(b), (c)
 
-/*
- * Draw rules with some sort of antialias support. Usefult for high-rate
- * scale factors.
- */ 
-
 static void draw_shrink_rule (DviContext *dvi, int x, int y, Uint w, Uint h, int f)
 {              
-       int hs, vs, npixels;
        Ulong fg, bg;
-       Ulong *pixels;
-       
-       hs = dvi->params.hshrink;
-       vs = dvi->params.vshrink;
+
        fg = dvi->curr_fg;
        bg = dvi->curr_bg;
 
-       if (MDVI_ENABLED(dvi, MDVI_PARAM_ANTIALIASED)) {
-               npixels = vs * hs + 1;
-               pixels = get_color_table(&dvi->device, npixels, bg, fg,
-                                        dvi->params.gamma, dvi->params.density);
-       
-               if (pixels) {
-                   int color;
-                   
-                   /*  Lines with width 1 should be perfectly visible
-                    *  in shrink about 15. That is the reason of constant
-                    */
-                    
-                   color = (pow (vs / h * hs, 2) + pow (hs / w * vs, 2)) / 225;
-                   if (color < npixels) {
-                       fg = pixels[color];
-                   } else {    
-                       fg = pixels[npixels - 1];
-                   }
-               }
-        }
-
        mdvi_push_color (dvi, fg, bg);
        dvi->device.draw_rule(dvi, x, y, w, h, f);
        mdvi_pop_color (dvi);
@@ -1537,6 +1507,10 @@ int      special(DviContext *dvi, int opcode)
        Int32   arg;
        
        arg = dugetn(dvi, opcode - DVI_XXX1 + 1);
+       if (arg <= 0) {
+               dvierr(dvi, _("malformed special length\n"));
+               return -1;
+       }
        s = mdvi_malloc(arg + 1);
        dread(dvi, s, arg);
        s[arg] = 0;