diff -urN TeX.orig/libs/xpdf/goo/gfile.cc TeX/libs/xpdf/goo/gfile.cc
--- TeX.orig/libs/xpdf/goo/gfile.cc	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/goo/gfile.cc	2006-06-03 11:48:11.000000000 +0200
@@ -437,6 +437,7 @@
 #endif
 }
 
+#ifndef PDF_PARSER_ONLY
 GBool openTempFile(GString **name, FILE **f, char *mode, char *ext) {
 #if defined(WIN32)
   //---------- Win32 ----------
@@ -521,6 +522,7 @@
   return gTrue;
 #endif
 }
+#endif
 
 GBool executeCommand(char *cmd) {
 #ifdef VMS
diff -urN TeX.orig/libs/xpdf/goo/gfile.h TeX/libs/xpdf/goo/gfile.h
--- TeX.orig/libs/xpdf/goo/gfile.h	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/goo/gfile.h	2006-06-03 11:48:11.000000000 +0200
@@ -46,6 +46,9 @@
 #    endif
 #  endif
 #endif
+#if defined(__DJGPP__)
+typedef unsigned int time_t;
+#endif
 #include "gtypes.h"
 
 class GString;
@@ -83,7 +86,9 @@
 // should be done to the returned file pointer; the file may be
 // reopened later for reading, but not for writing.  The <mode> string
 // should be "w" or "wb".  Returns true on success.
+#ifndef PDF_PARSER_ONLY
 extern GBool openTempFile(GString **name, FILE **f, char *mode, char *ext);
+#endif
 
 // Execute <command>.  Returns true on success.
 extern GBool executeCommand(char *cmd);
diff -urN TeX.orig/libs/xpdf/goo/gmem.c TeX/libs/xpdf/goo/gmem.c
--- TeX.orig/libs/xpdf/goo/gmem.c	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/goo/gmem.c	2006-06-03 11:48:11.000000000 +0200
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <stddef.h>
 #include <string.h>
+#include <limits.h>
 #include "gmem.h"
 
 #ifdef DEBUG_MEM
@@ -63,7 +64,7 @@
   int lst;
   unsigned long *trl, *p;
 
-  if (size == 0)
+  if (size <= 0)
     return NULL;
   size1 = gMemDataSize(size);
   if (!(mem = (char *)malloc(size1 + gMemHdrSize + gMemTrlSize))) {
@@ -86,7 +87,7 @@
 #else
   void *p;
 
-  if (size == 0)
+  if (size <= 0)
     return NULL;
   if (!(p = malloc(size))) {
     fprintf(stderr, "Out of memory\n");
@@ -102,7 +103,7 @@
   void *q;
   int oldSize;
 
-  if (size == 0) {
+  if (size <= 0) {
     if (p)
       gfree(p);
     return NULL;
@@ -120,7 +121,7 @@
 #else
   void *q;
 
-  if (size == 0) {
+  if (size <= 0) {
     if (p)
       free(p);
     return NULL;
@@ -140,8 +141,11 @@
 void *gmallocn(int nObjs, int objSize) {
   int n;
 
+  if (nObjs == 0) {
+    return NULL;
+  }
   n = nObjs * objSize;
-  if (objSize == 0 || n / objSize != nObjs) {
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
     fprintf(stderr, "Bogus memory allocation size\n");
     exit(1);
   }
@@ -151,8 +155,14 @@
 void *greallocn(void *p, int nObjs, int objSize) {
   int n;
 
+  if (nObjs == 0) {
+    if (p) {
+      gfree(p);
+    }
+    return NULL;
+  }
   n = nObjs * objSize;
-  if (objSize == 0 || n / objSize != nObjs) {
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
     fprintf(stderr, "Bogus memory allocation size\n");
     exit(1);
   }
diff -urN TeX.orig/libs/xpdf/goo/Makefile.in TeX/libs/xpdf/goo/Makefile.in
--- TeX.orig/libs/xpdf/goo/Makefile.in	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/goo/Makefile.in	2006-06-03 11:48:11.000000000 +0200
@@ -4,6 +4,8 @@
 #
 # Copyright 1996 Derek B. Noonburg
 #
+# Modified for pdftex by Martin Schröder 2005
+#
 #========================================================================
 
 srcdir = @srcdir@
@@ -13,7 +15,9 @@
 
 kpathsea_include_dir = -I../../../texk -I$(srcdir)/../../../texk
 ALLCFLAGS = $(CFLAGS) @DEFS@ -I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir)
-ALLCXXFLAGS = $(CXXFLAGS) @DEFS@ -I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir)
+ALLCXXFLAGS = $(CXXFLAGS) @DEFS@ \
+  -I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir) \
+  -DPDF_PARSER_ONLY
 CXXFLAGS = @CXXFLAGS@
 CC = @CC@
 CXX = @CXX@
diff -urN TeX.orig/libs/xpdf/xpdf/JBIG2Stream.cc TeX/libs/xpdf/xpdf/JBIG2Stream.cc
--- TeX.orig/libs/xpdf/xpdf/JBIG2Stream.cc	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/xpdf/JBIG2Stream.cc	2006-06-03 11:48:12.000000000 +0200
@@ -13,6 +13,7 @@
 #endif
 
 #include <stdlib.h>
+#include <limits.h>
 #include "GList.h"
 #include "Error.h"
 #include "JArithmeticDecoder.h"
@@ -681,6 +682,10 @@
   w = wA;
   h = hA;
   line = (wA + 7) >> 3;
+  if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
+    data = NULL;
+    return;
+  }
   // need to allocate one extra guard byte for use in combine()
   data = (Guchar *)gmalloc(h * line + 1);
   data[h * line] = 0;
@@ -692,6 +697,10 @@
   w = bitmap->w;
   h = bitmap->h;
   line = bitmap->line;
+  if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
+    data = NULL;
+    return;
+  }
   // need to allocate one extra guard byte for use in combine()
   data = (Guchar *)gmalloc(h * line + 1);
   memcpy(data, bitmap->data, h * line);
@@ -720,7 +729,7 @@
 }
 
 void JBIG2Bitmap::expand(int newH, Guint pixel) {
-  if (newH <= h) {
+  if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) {
     return;
   }
   // need to allocate one extra guard byte for use in combine()
@@ -2294,6 +2303,14 @@
       !readUWord(&stepX) || !readUWord(&stepY)) {
     goto eofError;
   }
+  if (w == 0 || h == 0 || w >= INT_MAX / h) {
+    error(getPos(), "Bad bitmap size in JBIG2 halftone segment");
+    return;
+  }
+  if (gridH == 0 || gridW >= INT_MAX / gridH) {
+    error(getPos(), "Bad grid size in JBIG2 halftone segment");
+    return;
+  }
 
   // get pattern dictionary
   if (nRefSegs != 1) {
diff -urN TeX.orig/libs/xpdf/xpdf/JPXStream.cc TeX/libs/xpdf/xpdf/JPXStream.cc
--- TeX.orig/libs/xpdf/xpdf/JPXStream.cc	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/xpdf/JPXStream.cc	2006-06-03 11:48:12.000000000 +0200
@@ -12,6 +12,7 @@
 #pragma implementation
 #endif
 
+#include <limits.h>
 #include "gmem.h"
 #include "Error.h"
 #include "JArithmeticDecoder.h"
@@ -235,7 +236,7 @@
 		for (pre = 0; pre < 1; ++pre) {
 		  precinct = &resLevel->precincts[pre];
 		  if (precinct->subbands) {
-		    for (sb = 0; sb < (r == 0 ? 1 : 3); ++sb) {
+		    for (sb = 0; sb < (Guint)(r == 0 ? 1 : 3); ++sb) {
 		      subband = &precinct->subbands[sb];
 		      gfree(subband->inclusion);
 		      gfree(subband->zeroBitPlane);
@@ -783,7 +784,7 @@
   int segType;
   GBool haveSIZ, haveCOD, haveQCD, haveSOT;
   Guint precinctSize, style;
-  Guint segLen, capabilities, comp, i, j, r;
+  Guint segLen, capabilities, nTiles, comp, i, j, r;
 
   //----- main header
   haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
@@ -818,8 +819,14 @@
 	            / img.xTileSize;
       img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
 	            / img.yTileSize;
-      img.tiles = (JPXTile *)gmallocn(img.nXTiles * img.nYTiles,
-				      sizeof(JPXTile));
+      nTiles = img.nXTiles * img.nYTiles;
+      // check for overflow before allocating memory
+      if (img.nXTiles <= 0 || img.nYTiles <= 0 ||
+	  img.nXTiles >= INT_MAX / img.nYTiles) {
+	error(getPos(), "Bad tile count in JPX SIZ marker segment");
+	return gFalse;
+      }
+      img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
       for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
 	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
 							 sizeof(JPXTileComp));
@@ -1827,7 +1834,7 @@
     }
     if (!bits) {
       // packet is empty -- clear all code-block inclusion flags
-      for (sb = 0; sb < (tile->res == 0 ? 1 : 3); ++sb) {
+      for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
 	subband = &precinct->subbands[sb];
 	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
 	  for (cbX = 0; cbX < subband->nXCBs; ++cbX) {
@@ -1838,7 +1845,7 @@
       }
     } else {
 
-      for (sb = 0; sb < (tile->res == 0 ? 1 : 3); ++sb) {
+      for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
 	subband = &precinct->subbands[sb];
 	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
 	  for (cbX = 0; cbX < subband->nXCBs; ++cbX) {
@@ -1983,7 +1990,7 @@
 
     //----- packet data
 
-    for (sb = 0; sb < (tile->res == 0 ? 1 : 3); ++sb) {
+    for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
       subband = &precinct->subbands[sb];
       for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
 	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {
diff -urN TeX.orig/libs/xpdf/xpdf/SecurityHandler.cc TeX/libs/xpdf/xpdf/SecurityHandler.cc
--- TeX.orig/libs/xpdf/xpdf/SecurityHandler.cc	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/xpdf/SecurityHandler.cc	2006-06-03 11:48:12.000000000 +0200
@@ -34,7 +34,9 @@
 SecurityHandler *SecurityHandler::make(PDFDoc *docA, Object *encryptDictA) {
   Object filterObj;
   SecurityHandler *secHdlr;
+#ifdef ENABLE_PLUGINS
   XpdfSecurityHandler *xsh;
+#endif
 
   encryptDictA->dictLookup("Filter", &filterObj);
   if (filterObj.isName("Standard")) {
diff -urN TeX.orig/libs/xpdf/xpdf/Stream.cc TeX/libs/xpdf/xpdf/Stream.cc
--- TeX.orig/libs/xpdf/xpdf/Stream.cc	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/xpdf/Stream.cc	2006-06-03 11:48:12.000000000 +0200
@@ -15,6 +15,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <stddef.h>
+#include <limits.h>
 #ifndef WIN32
 #include <unistd.h>
 #endif
@@ -401,18 +402,34 @@
 
 StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
 				 int widthA, int nCompsA, int nBitsA) {
+  int totalBits;
+
   str = strA;
   predictor = predictorA;
   width = widthA;
   nComps = nCompsA;
   nBits = nBitsA;
+  predLine = NULL;
+  ok = gFalse;
 
   nVals = width * nComps;
+  totalBits = nVals * nBits;
+  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+      nComps >= INT_MAX / nBits ||
+      width >= INT_MAX / nComps / nBits ||
+      nVals * nBits + 7 < 0) {
+    return;
+  }
   pixBytes = (nComps * nBits + 7) >> 3;
-  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+  rowBytes = ((totalBits + 7) >> 3) + pixBytes;
+  if (rowBytes < 0) {
+    return;
+  }
   predLine = (Guchar *)gmalloc(rowBytes);
   memset(predLine, 0, rowBytes);
   predIdx = rowBytes;
+
+  ok = gTrue;
 }
 
 StreamPredictor::~StreamPredictor() {
@@ -1004,6 +1021,10 @@
     FilterStream(strA) {
   if (predictor != 1) {
     pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
   } else {
     pred = NULL;
   }
@@ -1259,6 +1280,9 @@
   if (columns < 1) {
     columns = 1;
   }
+  if (columns + 4 <= 0) {
+    columns = INT_MAX - 4;
+  }
   rows = rowsA;
   endOfBlock = endOfBlockA;
   black = blackA;
@@ -2899,6 +2923,14 @@
   height = read16();
   width = read16();
   numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream", prec);
+    return gFalse;
+  }
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream", prec);
+    return gFalse;
+  }
   if (prec != 8) {
     error(getPos(), "Bad DCT precision %d", prec);
     return gFalse;
@@ -2925,6 +2957,16 @@
   height = read16();
   width = read16();
   numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream");
+    numComps = 0;
+    return gFalse;
+  }
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream");
+    numComps = 0;
+    return gFalse;
+  }
   if (prec != 8) {
     error(getPos(), "Bad DCT precision %d", prec);
     return gFalse;
@@ -2947,6 +2989,11 @@
 
   length = read16() - 2;
   scanInfo.numComps = str->getChar();
+  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream");
+    scanInfo.numComps = 0;
+    return gFalse;
+  }
   --length;
   if (length != 2 * scanInfo.numComps + 3) {
     error(getPos(), "Bad DCT scan info block");
@@ -3041,6 +3088,7 @@
 	numACHuffTables = index+1;
       tbl = &acHuffTables[index];
     } else {
+      index &= 0x0f;
       if (index >= numDCHuffTables)
 	numDCHuffTables = index+1;
       tbl = &dcHuffTables[index];
@@ -3827,6 +3875,10 @@
     FilterStream(strA) {
   if (predictor != 1) {
     pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
   } else {
     pred = NULL;
   }
diff -urN TeX.orig/libs/xpdf/xpdf/Stream.h TeX/libs/xpdf/xpdf/Stream.h
--- TeX.orig/libs/xpdf/xpdf/Stream.h	2006-06-03 10:15:38.000000000 +0200
+++ TeX/libs/xpdf/xpdf/Stream.h	2006-06-03 11:48:12.000000000 +0200
@@ -232,6 +232,8 @@
 
   ~StreamPredictor();
 
+  GBool isOk() { return ok; }
+
   int lookChar();
   int getChar();
 
@@ -249,6 +251,7 @@
   int rowBytes;			// bytes per line
   Guchar *predLine;		// line buffer
   int predIdx;			// current index in predLine
+  GBool ok;
 };
 
 //------------------------------------------------------------------------