diff -ur kdegraphics-orig/kpdf/xpdf/splash/Splash.cc kdegraphics-3.5.9/kpdf/xpdf/splash/Splash.cc
--- kdegraphics-orig/kpdf/xpdf/splash/Splash.cc	2008-02-13 10:37:05.000000000 +0100
+++ kdegraphics-3.5.9/kpdf/xpdf/splash/Splash.cc	2008-03-18 15:50:41.000000000 +0100
@@ -1674,15 +1674,37 @@
   Guchar *p;
   int x1, y1, xx, xx1, yy;
 
+  p = glyph->data;
+  int xStart = x0 - glyph->x;
+  int yStart = y0 - glyph->y;
+  int xxLimit = glyph->w;
+  int yyLimit = glyph->h;
+
+  if (yStart < 0)
+  {
+    p += glyph->w * -yStart; // move p to the beginning of the first painted row
+    yyLimit += yStart;
+    yStart = 0;
+  }
+
+  if (xStart < 0)
+  {
+    p += -xStart; // move p to the first painted pixel
+    xxLimit += xStart;
+    xStart = 0;
+  }
+
+  if (xxLimit + xStart >= bitmap->width) xxLimit = bitmap->width - xStart;
+  if (yyLimit + yStart >= bitmap->height) yyLimit = bitmap->height - yStart;
+
     if (noClip) {
       if (glyph->aa) {
-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
+	pipeInit(&pipe, xStart, yStart,
 		 state->fillPattern, NULL, state->fillAlpha, gTrue, gFalse);
-	p = glyph->data;
-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; ++xx, ++x1) {
-	    alpha = *p++;
+	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
+	  pipeSetXY(&pipe, xStart, y1);
+	  for (xx = 0, x1 = xStart; xx < xxLimit; ++xx, ++x1) {
+	    alpha = p[xx];
 	    if (alpha != 0) {
 	      pipe.shape = (SplashCoord)(alpha / 255.0);
 	      pipeRun(&pipe);
@@ -1692,16 +1714,18 @@
 	      pipeIncX(&pipe);
 	    }
 	  }
+	  p += glyph->w;
 	}
       } else {
-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
+	const int widthEight = (int)ceil(glyph->w / 8.0);
+
+	pipeInit(&pipe, xStart, yStart,
 		 state->fillPattern, NULL, state->fillAlpha, gFalse, gFalse);
-	p = glyph->data;
-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; xx += 8) {
-	    alpha0 = *p++;
-	    for (xx1 = 0; xx1 < 8 && xx + xx1 < glyph->w; ++xx1, ++x1) {
+	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
+	  pipeSetXY(&pipe, xStart, y1);
+	  for (xx = 0, x1 = xStart; xx < xxLimit; xx += 8) {
+	    alpha0 = p[xx / 8];
+	    for (xx1 = 0; xx1 < 8 && xx + xx1 < xxLimit; ++xx1, ++x1) {
 	      if (alpha0 & 0x80) {
 		pipeRun(&pipe);
 		updateModX(x1);
@@ -1712,18 +1736,18 @@
 	      alpha0 <<= 1;
 	    }
 	  }
+	  p += widthEight;
 	}
       }
     } else {
       if (glyph->aa) {
-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
+	pipeInit(&pipe, xStart, yStart,
 		 state->fillPattern, NULL, state->fillAlpha, gTrue, gFalse);
-	p = glyph->data;
-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; ++xx, ++x1) {
+	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
+	  pipeSetXY(&pipe, xStart, y1);
+	  for (xx = 0, x1 = xStart; xx < xxLimit; ++xx, ++x1) {
 	    if (state->clip->test(x1, y1)) {
-	      alpha = *p++;
+	      alpha = p[xx];
 	      if (alpha != 0) {
 		pipe.shape = (SplashCoord)(alpha / 255.0);
 		pipeRun(&pipe);
@@ -1734,19 +1758,20 @@
 	      }
 	    } else {
 	      pipeIncX(&pipe);
-	      ++p;
 	    }
 	  }
+	  p += glyph->w;
 	}
       } else {
-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
+	const int widthEight = (int)ceil(glyph->w / 8.0);
+
+	pipeInit(&pipe, xStart, yStart,
 		 state->fillPattern, NULL, state->fillAlpha, gFalse, gFalse);
-	p = glyph->data;
-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; xx += 8) {
-	    alpha0 = *p++;
-	    for (xx1 = 0; xx1 < 8 && xx + xx1 < glyph->w; ++xx1, ++x1) {
+	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
+	  pipeSetXY(&pipe, xStart, y1);
+	  for (xx = 0, x1 = xStart; xx < xxLimit; xx += 8) {
+	    alpha0 = p[xx / 8];
+	    for (xx1 = 0; xx1 < 8 && xx + xx1 < xxLimit; ++xx1, ++x1) {
 	      if (state->clip->test(x1, y1)) {
 		if (alpha0 & 0x80) {
 		  pipeRun(&pipe);
@@ -1761,6 +1786,7 @@
 	      alpha0 <<= 1;
 	    }
 	  }
+	  p += widthEight;
 	}
       }
     }
diff -ur kdegraphics-orig/kpdf/xpdf/splash/SplashXPathScanner.cc kdegraphics-3.5.9/kpdf/xpdf/splash/SplashXPathScanner.cc
--- kdegraphics-orig/kpdf/xpdf/splash/SplashXPathScanner.cc	2007-05-14 09:39:31.000000000 +0200
+++ kdegraphics-3.5.9/kpdf/xpdf/splash/SplashXPathScanner.cc	2008-03-18 15:50:49.000000000 +0100
@@ -397,7 +397,7 @@
 	for (; xx + 7 <= xx0; xx += 8) {
 	  *p++ = 0x00;
 	}
-	if (xx <= xx0) {
+	if (xx < xx0) {
 	  *p &= 0xff >> (xx0 & 7);
 	}
       }
@@ -406,6 +406,7 @@
       }
     }
     xx0 = (*x1 + 1) * splashAASize;
+    if (xx0 > aaBuf->getWidth()) xx0 = aaBuf->getWidth();
     // set [xx, xx0) to 0
     if (xx < xx0) {
       p = aaBuf->getDataPtr() + yy * aaBuf->getRowSize() + (xx >> 3);
@@ -420,7 +421,7 @@
       for (; xx + 7 <= xx0; xx += 8) {
 	*p++ = 0x00;
       }
-      if (xx <= xx0) {
+      if (xx < xx0) {
 	*p &= 0xff >> (xx0 & 7);
       }
     }
diff -ur kdegraphics-orig/kpdf/xpdf/xpdf/Lexer.cc kdegraphics-3.5.9/kpdf/xpdf/xpdf/Lexer.cc
--- kdegraphics-orig/kpdf/xpdf/xpdf/Lexer.cc	2008-02-13 10:37:05.000000000 +0100
+++ kdegraphics-3.5.9/kpdf/xpdf/xpdf/Lexer.cc	2008-03-18 15:50:04.000000000 +0100
@@ -298,7 +298,7 @@
 	  n = 0;
 	  
 	  // we are growing see if the document is not malformed and we are growing too much
-	  if (objNum > 0)
+	  if (objNum > 0 && xref != NULL)
 	  {
 	    int newObjNum = xref->getNumEntry(curStr.streamGetPos());
 	    if (newObjNum != objNum)