--- poppler/JBIG2Stream.orig.cc 2006-04-04 15:38:23.000000000 -0700 +++ poppler/JBIG2Stream.cc 2006-04-04 15:37:22.000000000 -0700 @@ -1229,6 +1229,7 @@ Guint segNum, segFlags, segType, page, segLength; Guint refFlags, nRefSegs; Guint *refSegs; + int segDataPos; int c1, c2, c3; Guint i; @@ -1296,6 +1297,9 @@ goto eofError2; } + // keep track of the start of the segment data + segDataPos = getPos(); + // read the segment data switch (segType) { case 0: @@ -1373,6 +1377,45 @@ break; } + // Make sure the segment handler read all of the bytes in the + // segment data, unless this segment is marked as having an + // unknown length (section 7.2.7 of the JBIG2 Final Committee Draft) + + if (segLength != 0xffffffff) { + + int segExtraBytes = segDataPos + segLength - getPos(); + if (segExtraBytes > 0) { + + // If we didn't read all of the bytes in the segment data, + // indicate an error, and throw away the rest of the data. + + // v.3.1.01.13 of the LuraTech PDF Compressor Server will + // sometimes generate an extraneous NULL byte at the end of + // arithmetic-coded symbol dictionary segments when numNewSyms + // == 0. Segments like this often occur for blank pages. + + error(getPos(), "%d extraneous byte%s after segment", + segExtraBytes, (segExtraBytes > 1) ? "s" : ""); + + // Burn through the remaining bytes -- inefficient, but + // hopefully we're not doing this much + + int trash; + for (int i = segExtraBytes; i > 0; i--) { + readByte(&trash); + } + + } else if (segExtraBytes < 0) { + + // If we read more bytes than we should have, according to the + // segment length field, note an error. + + error(getPos(), "Previous segment handler read too many bytes"); + + } + + } + gfree(refSegs); }