Re: 2.99.1: new beta / almost release candidate

>From xpdf-3.00-5.2.100mdk.src.rpm, I see as
xpdf-3.00-CAN-2004-0888-0889.patch.bz2 (from Oct. 19). Does this work or
does it suffer from gcc optimizations? At least, one place (see below)
explicitly says that this works...

--- xpdf-3.00/xpdf/XRef.cc.CAN-2004-0888-0889   2004-10-19 08:58:47.000000000 -0600
+++ xpdf-3.00/xpdf/XRef.cc      2004-10-19 08:58:47.000000000 -0600
@@ -110,6 +110,10 @@
     goto err1;
   }
 
+  if (nObjects*sizeof(int)/sizeof(int) != nObjects) {
+    error(-1, "Invalid 'nObjects'");
+    goto err1;
+  }
   objs = new Object[nObjects];
   objNums = (int *)gmalloc(nObjects * sizeof(int));
   offsets = (int *)gmalloc(nObjects * sizeof(int));
@@ -385,6 +389,10 @@
       for (newSize = size ? 2 * size : 1024;
           first + n > newSize && newSize > 0;
           newSize <<= 1) ;
+      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
+       error(-1, "Invalid 'obj' parameters'");
+       return gFalse;
+      }
       if (newSize < 0) {
        goto err1;
       }
@@ -493,6 +501,10 @@
     goto err1;
   }
   if (newSize > size) {
+    if (newSize * sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
+      error(-1, "Invalid 'size' parameter.");
+      return gFalse;
+    }
     entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
     for (i = size; i < newSize; ++i) {
       entries[i].offset = 0xffffffff;
@@ -580,6 +592,10 @@
     for (newSize = size ? 2 * size : 1024;
         first + n > newSize && newSize > 0;
         newSize <<= 1) ;
+    if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
+      error(-1, "Invalid 'size' inside xref table.");
+      return gFalse;
+    }
     if (newSize < 0) {
       return gFalse;
     }
@@ -714,6 +730,10 @@
              if (!strncmp(p, "obj", 3)) {
                if (num >= size) {
                  newSize = (num + 1 + 255) & ~255;
+                 if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
+                   error(-1, "Invalid 'obj' parameters.");
+                   return gFalse;
+                 }
                  if (newSize < 0) {
                    error(-1, "Bad object number");
                    return gFalse;
@@ -741,6 +761,10 @@
     } else if (!strncmp(p, "endstream", 9)) {
       if (streamEndsLen == streamEndsSize) {
        streamEndsSize += 64;
+        if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
+          error(-1, "Invalid 'endstream' parameter.");
+          return gFalse;
+        }
        streamEnds = (Guint *)grealloc(streamEnds,
                                       streamEndsSize * sizeof(int));
       }
--- xpdf-3.00/xpdf/Catalog.cc.CAN-2004-0888-0889        2004-01-21 18:26:45.000000000 -0700
+++ xpdf-3.00/xpdf/Catalog.cc   2004-10-19 09:02:12.000000000 -0600
@@ -64,6 +64,15 @@
   }
   pagesSize = numPages0 = (int)obj.getNum();
   obj.free();
+  // The gcc doesnt optimize this away, so this check is ok,
+  // even if it looks like a pagesSize != pagesSize check
+  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
+      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
+    error(-1, "Invalid 'pagesSize'");
+    ok = gFalse;
+    return;
+  }
+
   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
   for (i = 0; i < pagesSize; ++i) {
@@ -191,6 +200,11 @@
       }
       if (start >= pagesSize) {
        pagesSize += 32;
+        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
+               pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
+          error(-1, "Invalid 'pagesSize' parameter.");
+          goto err3;
+        }
        pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
        pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
        for (j = pagesSize - 32; j < pagesSize; ++j) {