Description: fix multiple code execution issues
Origin: backported from 1.0.47 release

Index: cups-filters-1.0.24/filter/pdftoopvp/oprs/OPVPSplash.cxx
===================================================================
--- cups-filters-1.0.24.orig/filter/pdftoopvp/oprs/OPVPSplash.cxx	2014-03-11 11:00:33.576348260 -0400
+++ cups-filters-1.0.24/filter/pdftoopvp/oprs/OPVPSplash.cxx	2014-03-11 11:00:33.572348260 -0400
@@ -1094,7 +1094,7 @@
     
     opvpbytes = (m+3)/4;
     opvpbytes *= 4;
-    bp = (Guchar *)gmalloc(opvpbytes*glyph->h);
+    bp = (Guchar *)gmallocn(glyph->h,opvpbytes);
     for (i = 0;i < glyph->h;i++) {
       memcpy(bp+i*opvpbytes,glyph->data+i*m,m);
     }
@@ -1238,8 +1238,8 @@
   /* align 4 */
   opvpbytes = (opvpbytes+3)/4;
   opvpbytes *= 4;
-  buf = (Guchar *)gmalloc(opvpbytes*h);
-  lineBuf = (SplashColorPtr)gmalloc(opvpbytes*8);
+  buf = (Guchar *)gmallocn(h,opvpbytes);
+  lineBuf = (SplashColorPtr)gmallocn(8,opvpbytes);
 
   for (i = 0;i < h;i++) {
     int k;
@@ -1417,7 +1417,7 @@
   imat[3] = mat[0]/det;
 
   /* read source image */
-  pixBuf = (SplashColorPtr)gmalloc(h * w);
+  pixBuf = (SplashColorPtr)gmallocn(h , w);
 
   p = pixBuf;
   for (i = 0; i < h; ++i) {
@@ -1571,8 +1571,8 @@
     hs = h-1;
     he = -1;
   }
-  buf = (Guchar *)gmalloc(opvpbytes*h);
-  lineBuf = (SplashColorPtr)gmalloc(lineBufSize);
+  buf = (Guchar *)gmallocn(h,opvpbytes);
+  lineBuf = (SplashColorPtr)gmallocn(lineBufSize,1);
   switch (colorMode) {
   case splashModeMono1:
   case splashModeMono8:
@@ -1734,7 +1734,7 @@
     return splashErrOPVP;
     break;
   }
-  buf = (Guchar *)gmalloc(opvpbytes*h);
+  buf = (Guchar *)gmallocn(h,opvpbytes);
 
   switch (colorMode) {
   case splashModeMono1:
@@ -1960,7 +1960,7 @@
   }
 
   /* read source image */
-  pixBuf = (SplashColorPtr)gmalloc(h * linesize);
+  pixBuf = (SplashColorPtr)gmallocn(h , linesize);
 
   p = pixBuf;
   for (i = 0; i < h; ++i) {
@@ -1968,8 +1968,8 @@
     p += linesize;
   }
   /* allocate line buffer */
-  Guchar *lineBuf = (Guchar *)gmalloc(opvpbytes);
-  Guchar *onBuf = (Guchar *)gmalloc(width);
+  Guchar *lineBuf = (Guchar *)gmallocn(opvpbytes,1);
+  Guchar *onBuf = (Guchar *)gmallocn(width,1);
   OPVPSplashClip *clip;
   opvpctm.a = 1.0;
   opvpctm.b = 0.0;
Index: cups-filters-1.0.24/filter/pdftoopvp/oprs/OPVPWrapper.cxx
===================================================================
--- cups-filters-1.0.24.orig/filter/pdftoopvp/oprs/OPVPWrapper.cxx	2014-03-11 11:00:33.576348260 -0400
+++ cups-filters-1.0.24/filter/pdftoopvp/oprs/OPVPWrapper.cxx	2014-03-11 11:00:33.576348260 -0400
@@ -822,6 +822,12 @@
     void *handle = 0;
     OPVPWrapper *opvp = 0;
 
+    // remove directory part
+    const char *s = strrchr(driverName,'/');
+    if (s != NULL) {
+        driverName = s+1;
+    }
+
     list = genDynamicLibName(driverName);
 
     if (list) {
Index: cups-filters-1.0.24/filter/pdftoopvp/OPVPOutputDev.cxx
===================================================================
--- cups-filters-1.0.24.orig/filter/pdftoopvp/OPVPOutputDev.cxx	2014-03-11 11:00:33.576348260 -0400
+++ cups-filters-1.0.24/filter/pdftoopvp/OPVPOutputDev.cxx	2014-03-11 11:00:33.576348260 -0400
@@ -147,8 +147,8 @@
   } else {
     cacheSets = 1;
   }
-  cacheData = (Guchar *)gmalloc(cacheSets * cacheAssoc * glyphSize);
-  cacheTags = (T3FontCacheTag *)gmalloc(cacheSets * cacheAssoc *
+  cacheData = (Guchar *)gmallocn3(cacheSets , cacheAssoc , glyphSize);
+  cacheTags = (T3FontCacheTag *)gmallocn3(cacheSets , cacheAssoc ,
 					sizeof(T3FontCacheTag));
   for (i = 0; i < cacheSets * cacheAssoc; ++i) {
     cacheTags[i].mru = i & (cacheAssoc - 1);
@@ -1416,7 +1416,7 @@
     switch (colorMode) {
     case splashModeMono1:
     case splashModeMono8:
-      imgData.lookup = (SplashColorPtr)gmalloc(n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,1);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getGray(&pix, &gray);
@@ -1424,7 +1424,7 @@
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1434,7 +1434,7 @@
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1445,7 +1445,7 @@
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,4);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
@@ -1672,7 +1672,7 @@
     switch (colorMode) {
     case splashModeMono1:
     case splashModeMono8:
-      imgData.lookup = (SplashColorPtr)gmalloc(n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,1);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getGray(&pix, &gray);
@@ -1680,7 +1680,7 @@
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1690,7 +1690,7 @@
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1701,7 +1701,7 @@
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,4);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
@@ -1793,7 +1793,7 @@
   imgMaskData.height = maskHeight;
   imgMaskData.y = 0;
   n = 1 << maskColorMap->getBits();
-  imgMaskData.lookup = (SplashColorPtr)gmalloc(n);
+  imgMaskData.lookup = (SplashColorPtr)gmallocn(n,1);
   for (i = 0; i < n; ++i) {
     pix = (Guchar)i;
     maskColorMap->getGray(&pix, &gray);
@@ -1833,7 +1833,7 @@
     switch (colorMode) {
     case splashModeMono1:
     case splashModeMono8:
-      imgData.lookup = (SplashColorPtr)gmalloc(n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,1);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getGray(&pix, &gray);
@@ -1841,7 +1841,7 @@
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1851,7 +1851,7 @@
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,3);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1862,7 +1862,7 @@
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n,4);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
