diff -u -5 -d -p -r1.4 Gfx.cc
--- kpdf/xpdf/Gfx.cc	28 Sep 2003 12:17:12 -0000	1.4
+++ kpdf/xpdf/Gfx.cc	22 Dec 2004 12:04:49 -0000
@@ -2379,11 +2379,13 @@ void Gfx::doImage(Object *ref, Stream *s
 
     // get the mask
     haveMask = gFalse;
     dict->lookup("Mask", &maskObj);
     if (maskObj.isArray()) {
-      for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+      for (i = 0;
+	   i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+	   ++i) {
 	maskObj.arrayGet(i, &obj1);
 	maskColors[i] = obj1.getInt();
 	obj1.free();
       }
       haveMask = gTrue;
diff -u -5 -d -p -r1.3 GfxState.cc
--- kpdf/xpdf/GfxState.cc	20 Aug 2003 21:25:12 -0000	1.3
+++ kpdf/xpdf/GfxState.cc	22 Dec 2004 12:04:49 -0000
@@ -706,10 +706,15 @@ GfxColorSpace *GfxICCBasedColorSpace::pa
     obj1.free();
     return NULL;
   }
   nCompsA = obj2.getInt();
   obj2.free();
+  if (nCompsA > gfxColorMaxComps) {
+    error(-1, "ICCBased color space with too many (%d > %d) components",
+          nCompsA, gfxColorMaxComps);
+    nCompsA = gfxColorMaxComps;
+  }
   if (dict->lookup("Alternate", &obj2)->isNull() ||
       !(altA = GfxColorSpace::parse(&obj2))) {
     switch (nCompsA) {
     case 1:
       altA = new GfxDeviceGrayColorSpace();
@@ -1045,10 +1050,15 @@ GfxColorSpace *GfxDeviceNColorSpace::par
   if (!arr->get(1, &obj1)->isArray()) {
     error(-1, "Bad DeviceN color space (names)");
     goto err2;
   }
   nCompsA = obj1.arrayGetLength();
+  if (nCompsA > gfxColorMaxComps) {
+    error(-1, "DeviceN color space with too many (%d > %d) components",
+          nCompsA, gfxColorMaxComps);
+    nCompsA = gfxColorMaxComps;
+  }
   for (i = 0; i < nCompsA; ++i) {
     if (!obj1.arrayGet(i, &obj2)->isName()) {
       error(-1, "Bad DeviceN color space (names)");
       obj2.free();
       goto err2;