1 files changed, 11 insertions, 2 deletions

diff --git a/noncore/unsupported/qpdf/xpdf/Function.cc b/noncore/unsupported/qpdf/xpdf/Function.cc
index 815cc89..ebf3718 100644
--- a/noncore/unsupported/qpdf/xpdf/Function.cc
+++ b/noncore/unsupported/qpdf/xpdf/Function.cc
@@ -1,11 +1,11 @@
 //========================================================================
 //
 // Function.cc
 //
-// Copyright 2001 Derek B. Noonburg
+// Copyright 2001-2002 Glyph & Cog, LLC
 //
 //========================================================================
 
 #ifdef __GNUC__
 #pragma implementation
 #endif
@@ -412,33 +412,34 @@ void SampledFunction::transform(fouble *in, fouble *out) {
 ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
   Object obj1, obj2;
   GBool hasN;
   int i;
 
   ok = gFalse;
-  hasN = gFalse;
 
   //----- initialize the generic stuff
   if (!init(dict)) {
     goto err1;
   }
   if (m != 1) {
     error(-1, "Exponential function with more than one input");
     goto err1;
   }
+  hasN = hasRange;
 
   //----- default values
   for (i = 0; i < funcMaxOutputs; ++i) {
     c0[i] = 0;
     c1[i] = 1;
   }
 
   //----- C0
   if (dict->lookup("C0", &obj1)->isArray()) {
     if (!hasN) {
       n = obj1.arrayGetLength();
+      hasN = gTrue;
     } else if (obj1.arrayGetLength() != n) {
       error(-1, "Function's C0 array is wrong length");
       goto err2;
     }
     for (i = 0; i < n; ++i) {
       obj1.arrayGet(i, &obj2);
@@ -453,12 +454,13 @@ ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
   obj1.free();
 
   //----- C1
   if (dict->lookup("C1", &obj1)->isArray()) {
     if (!hasN) {
       n = obj1.arrayGetLength();
+      hasN = gTrue;
     } else if (obj1.arrayGetLength() != n) {
       error(-1, "Function's C1 array is wrong length");
       goto err2;
     }
     for (i = 0; i < n; ++i) {
       obj1.arrayGet(i, &obj2);
@@ -477,12 +479,19 @@ ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
     error(-1, "Function has missing or invalid N");
     goto err2;
   }
   e = obj1.getNum();
   obj1.free();
 
+  // this isn't supposed to happen, but I've run into (broken) PDF
+  // files where it does
+  if (!hasN) {
+    error(-1, "Exponential function does not define number of output values");
+    n = 1;
+  }
+
   ok = gTrue;
   return;
 
  err3:
   obj2.free();
  err2: