xpdf-3.02的一个bug

在函数SplashXPath::SplashXPath()中的这段代码
参考：
http://lists.freedesktop.org/archives/poppler/2007-April/002562.html

  pts = (SplashXPathPoint *)gmallocn(path->length, sizeof(SplashXPathPoint));

   ....

  for (i = 0; i < path->hintsLength; ++i) {
      hint = &path->hints[i];
+      if (hint->ctrl0 + 1 >= path->length || hint->ctrl1 + 1 >= path->length) {
+	gfree(adjusts);
+	adjusts = NULL;
+	break;
+      }
      x0 = pts[hint->ctrl0    ].x;    y0 = pts[hint->ctrl0    ].y;
      x1 = pts[hint->ctrl0 + 1].x;    y1 = pts[hint->ctrl0 + 1].y;
      x2 = pts[hint->ctrl1    ].x;    y2 = pts[hint->ctrl1    ].y;
      x3 = pts[hint->ctrl1 + 1].x;    y3 = pts[hint->ctrl1 + 1].y;

如果没有打上行首以加号标示的补丁，如果hint->ctrl1+1>=path->length,xpdf会崩溃，我碰到的一个pdf文件就有这样的问题。

”http://catalogueshopper.com.au/CatalogueFiles/CAT246.pdf“ 第40或者第41页。