diff -rupN poppler-0.45.0/poppler/GfxState.cc poppler-0.45.0-new/poppler/GfxState.cc
--- poppler-0.45.0/poppler/GfxState.cc 2016-05-04 23:21:40.000000000 +0200
+++ poppler-0.45.0-new/poppler/GfxState.cc 2017-07-14 11:27:53.857626269 +0200
@@ -4022,11 +4022,17 @@ GfxUnivariateShading::~GfxUnivariateShad
void GfxUnivariateShading::getColor(double t, GfxColor *color) {
double out[gfxColorMaxComps];
- int i, nComps;
+ int i;
// NB: there can be one function with n outputs or n functions with
// one output each (where n = number of color components)
- nComps = nFuncs * funcs[0]->getOutputSize();
+ const int nComps = nFuncs * funcs[0]->getOutputSize();
+
+ if (unlikely(nFuncs < 1 || nComps > gfxColorMaxComps)) {
+ for (int i = 0; i < gfxColorMaxComps; i++)
+ color->c[i] = 0;
+ return;
+ }
if (cacheSize > 0) {
double x, ix, *l, *u, *upper;
@@ -4077,6 +4083,9 @@ void GfxUnivariateShading::setupCache(co
cacheBounds = NULL;
cacheSize = 0;
+ if (unlikely(nFuncs < 1))
+ return;
+
// NB: there can be one function with n outputs or n functions with
// one output each (where n = number of color components)
nComps = nFuncs * funcs[0]->getOutputSize();