*** Gfx.cc.orig	Sun Dec 12 16:04:43 2004

--- Gfx.cc	Sun Dec 12 16:05:16 2004

***************

*** 2654,2660 ****

      haveMask = gFalse;

      dict->lookup("Mask", &maskObj);

      if (maskObj.isArray()) {

!       for (i = 0; i < maskObj.arrayGetLength(); ++i) {

  	maskObj.arrayGet(i, &obj1);

  	maskColors[i] = obj1.getInt();

  	obj1.free();

--- 2654,2662 ----

      haveMask = gFalse;

      dict->lookup("Mask", &maskObj);

      if (maskObj.isArray()) {

!       for (i = 0;

! 	   i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;

! 	   ++i) {

  	maskObj.arrayGet(i, &obj1);

  	maskColors[i] = obj1.getInt();

  	obj1.free();

*** GfxState.cc.orig	Sun Dec 12 16:04:48 2004

--- GfxState.cc	Sun Dec 12 16:06:38 2004

***************

*** 708,713 ****

--- 708,718 ----

    }

    nCompsA = obj2.getInt();

    obj2.free();

+   if (nCompsA > gfxColorMaxComps) {

+     error(-1, "ICCBased color space with too many (%d > %d) components",

+ 	  nCompsA, gfxColorMaxComps);

+     nCompsA = gfxColorMaxComps;

+   }

    if (dict->lookup("Alternate", &obj2)->isNull() ||

        !(altA = GfxColorSpace::parse(&obj2))) {

      switch (nCompsA) {

***************

*** 1054,1060 ****

    }

    nCompsA = obj1.arrayGetLength();

    if (nCompsA > gfxColorMaxComps) {

!     error(-1, "DeviceN color space with more than %d > %d components",

  	  nCompsA, gfxColorMaxComps);

      nCompsA = gfxColorMaxComps;

    }

--- 1059,1065 ----

    }

    nCompsA = obj1.arrayGetLength();

    if (nCompsA > gfxColorMaxComps) {

!     error(-1, "DeviceN color space with too many (%d > %d) components",

  	  nCompsA, gfxColorMaxComps);

      nCompsA = gfxColorMaxComps;

    }