diff --git a/kdegraphics-3.5.9-kpdf-crashes.patch b/kdegraphics-3.5.9-kpdf-crashes.patch
new file mode 100644
index 0000000..ed74246
--- /dev/null
+++ b/kdegraphics-3.5.9-kpdf-crashes.patch
@@ -0,0 +1,176 @@
+diff -ur kdegraphics-orig/kpdf/xpdf/splash/Splash.cc kdegraphics-3.5.9/kpdf/xpdf/splash/Splash.cc
+--- kdegraphics-orig/kpdf/xpdf/splash/Splash.cc	2008-02-13 10:37:05.000000000 +0100
++++ kdegraphics-3.5.9/kpdf/xpdf/splash/Splash.cc	2008-03-18 15:50:41.000000000 +0100
+@@ -1674,15 +1674,37 @@
+   Guchar *p;
+   int x1, y1, xx, xx1, yy;
+ 
++  p = glyph->data;
++  int xStart = x0 - glyph->x;
++  int yStart = y0 - glyph->y;
++  int xxLimit = glyph->w;
++  int yyLimit = glyph->h;
++
++  if (yStart < 0)
++  {
++    p += glyph->w * -yStart; // move p to the beginning of the first painted row
++    yyLimit += yStart;
++    yStart = 0;
++  }
++
++  if (xStart < 0)
++  {
++    p += -xStart; // move p to the first painted pixel
++    xxLimit += xStart;
++    xStart = 0;
++  }
++
++  if (xxLimit + xStart >= bitmap->width) xxLimit = bitmap->width - xStart;
++  if (yyLimit + yStart >= bitmap->height) yyLimit = bitmap->height - yStart;
++
+     if (noClip) {
+       if (glyph->aa) {
+-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
++	pipeInit(&pipe, xStart, yStart,
+ 		 state->fillPattern, NULL, state->fillAlpha, gTrue, gFalse);
+-	p = glyph->data;
+-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
+-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
+-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; ++xx, ++x1) {
+-	    alpha = *p++;
++	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
++	  pipeSetXY(&pipe, xStart, y1);
++	  for (xx = 0, x1 = xStart; xx < xxLimit; ++xx, ++x1) {
++	    alpha = p[xx];
+ 	    if (alpha != 0) {
+ 	      pipe.shape = (SplashCoord)(alpha / 255.0);
+ 	      pipeRun(&pipe);
+@@ -1692,16 +1714,18 @@
+ 	      pipeIncX(&pipe);
+ 	    }
+ 	  }
++	  p += glyph->w;
+ 	}
+       } else {
+-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
++	const int widthEight = (int)ceil(glyph->w / 8.0);
++
++	pipeInit(&pipe, xStart, yStart,
+ 		 state->fillPattern, NULL, state->fillAlpha, gFalse, gFalse);
+-	p = glyph->data;
+-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
+-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
+-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; xx += 8) {
+-	    alpha0 = *p++;
+-	    for (xx1 = 0; xx1 < 8 && xx + xx1 < glyph->w; ++xx1, ++x1) {
++	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
++	  pipeSetXY(&pipe, xStart, y1);
++	  for (xx = 0, x1 = xStart; xx < xxLimit; xx += 8) {
++	    alpha0 = p[xx / 8];
++	    for (xx1 = 0; xx1 < 8 && xx + xx1 < xxLimit; ++xx1, ++x1) {
+ 	      if (alpha0 & 0x80) {
+ 		pipeRun(&pipe);
+ 		updateModX(x1);
+@@ -1712,18 +1736,18 @@
+ 	      alpha0 <<= 1;
+ 	    }
+ 	  }
++	  p += widthEight;
+ 	}
+       }
+     } else {
+       if (glyph->aa) {
+-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
++	pipeInit(&pipe, xStart, yStart,
+ 		 state->fillPattern, NULL, state->fillAlpha, gTrue, gFalse);
+-	p = glyph->data;
+-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
+-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
+-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; ++xx, ++x1) {
++	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
++	  pipeSetXY(&pipe, xStart, y1);
++	  for (xx = 0, x1 = xStart; xx < xxLimit; ++xx, ++x1) {
+ 	    if (state->clip->test(x1, y1)) {
+-	      alpha = *p++;
++	      alpha = p[xx];
+ 	      if (alpha != 0) {
+ 		pipe.shape = (SplashCoord)(alpha / 255.0);
+ 		pipeRun(&pipe);
+@@ -1734,19 +1758,20 @@
+ 	      }
+ 	    } else {
+ 	      pipeIncX(&pipe);
+-	      ++p;
+ 	    }
+ 	  }
++	  p += glyph->w;
+ 	}
+       } else {
+-	pipeInit(&pipe, x0 - glyph->x, y0 - glyph->y,
++	const int widthEight = (int)ceil(glyph->w / 8.0);
++
++	pipeInit(&pipe, xStart, yStart,
+ 		 state->fillPattern, NULL, state->fillAlpha, gFalse, gFalse);
+-	p = glyph->data;
+-	for (yy = 0, y1 = y0 - glyph->y; yy < glyph->h; ++yy, ++y1) {
+-	  pipeSetXY(&pipe, x0 - glyph->x, y1);
+-	  for (xx = 0, x1 = x0 - glyph->x; xx < glyph->w; xx += 8) {
+-	    alpha0 = *p++;
+-	    for (xx1 = 0; xx1 < 8 && xx + xx1 < glyph->w; ++xx1, ++x1) {
++	for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
++	  pipeSetXY(&pipe, xStart, y1);
++	  for (xx = 0, x1 = xStart; xx < xxLimit; xx += 8) {
++	    alpha0 = p[xx / 8];
++	    for (xx1 = 0; xx1 < 8 && xx + xx1 < xxLimit; ++xx1, ++x1) {
+ 	      if (state->clip->test(x1, y1)) {
+ 		if (alpha0 & 0x80) {
+ 		  pipeRun(&pipe);
+@@ -1761,6 +1786,7 @@
+ 	      alpha0 <<= 1;
+ 	    }
+ 	  }
++	  p += widthEight;
+ 	}
+       }
+     }
+diff -ur kdegraphics-orig/kpdf/xpdf/splash/SplashXPathScanner.cc kdegraphics-3.5.9/kpdf/xpdf/splash/SplashXPathScanner.cc
+--- kdegraphics-orig/kpdf/xpdf/splash/SplashXPathScanner.cc	2007-05-14 09:39:31.000000000 +0200
++++ kdegraphics-3.5.9/kpdf/xpdf/splash/SplashXPathScanner.cc	2008-03-18 15:50:49.000000000 +0100
+@@ -397,7 +397,7 @@
+ 	for (; xx + 7 <= xx0; xx += 8) {
+ 	  *p++ = 0x00;
+ 	}
+-	if (xx <= xx0) {
++	if (xx < xx0) {
+ 	  *p &= 0xff >> (xx0 & 7);
+ 	}
+       }
+@@ -406,6 +406,7 @@
+       }
+     }
+     xx0 = (*x1 + 1) * splashAASize;
++    if (xx0 > aaBuf->getWidth()) xx0 = aaBuf->getWidth();
+     // set [xx, xx0) to 0
+     if (xx < xx0) {
+       p = aaBuf->getDataPtr() + yy * aaBuf->getRowSize() + (xx >> 3);
+@@ -420,7 +421,7 @@
+       for (; xx + 7 <= xx0; xx += 8) {
+ 	*p++ = 0x00;
+       }
+-      if (xx <= xx0) {
++      if (xx < xx0) {
+ 	*p &= 0xff >> (xx0 & 7);
+       }
+     }
+diff -ur kdegraphics-orig/kpdf/xpdf/xpdf/Lexer.cc kdegraphics-3.5.9/kpdf/xpdf/xpdf/Lexer.cc
+--- kdegraphics-orig/kpdf/xpdf/xpdf/Lexer.cc	2008-02-13 10:37:05.000000000 +0100
++++ kdegraphics-3.5.9/kpdf/xpdf/xpdf/Lexer.cc	2008-03-18 15:50:04.000000000 +0100
+@@ -298,7 +298,7 @@
+ 	  n = 0;
+ 	  
+ 	  // we are growing see if the document is not malformed and we are growing too much
+-	  if (objNum > 0)
++	  if (objNum > 0 && xref != NULL)
+ 	  {
+ 	    int newObjNum = xref->getNumEntry(curStr.streamGetPos());
+ 	    if (newObjNum != objNum)
diff --git a/kdegraphics.spec b/kdegraphics.spec
index 0c43d10..adf323d 100644
--- a/kdegraphics.spec
+++ b/kdegraphics.spec
@@ -22,7 +22,7 @@ Name:    kdegraphics
 Summary: K Desktop Environment - Graphics Applications
 Epoch:   7
 Version: 3.5.9
-Release: 1%{?dist}.1
+Release: 2%{?dist}
 
 License: GPLv2
 Group:   Applications/Multimedia
@@ -34,6 +34,9 @@ Patch1: kdegraphics-3.3.0-misc.patch
 Patch2: kdegraphics-3.3.1-xorg.patch
 Patch3: kdegraphics-3.5.1-warning.patch
 
+# upstream patches
+Patch50: kdegraphics-3.5.9-kpdf-crashes.patch
+
 Provides: kdegraphics3 = %{version}-%{release}
 
 Requires: ghostscript
@@ -150,6 +153,9 @@ Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
 %patch2 -p1 -b .xorg
 %patch3 -p1 -b .gcc-warning
 
+#upstream patches
+%patch50 -p1 -b .kpdf-crashes
+
 %if %{make_cvs}
    make -f admin/Makefile.common cvs
 %endif
@@ -374,7 +380,10 @@ update-desktop-database %{_datadir}/applications > /dev/null 2>&1 || :
 
 
 %changelog
-* Fri Dec 15 2008 Rex Dieter <rdieter@fedoraproject.org> 7:3.5.9-1
+* Tue Mar 18 2008 Lukáš Tinkl <ltinkl@redhat.com> 7:3.5.9-2
+- fix various crashes in kpdf (#437965)
+
+* Fri Feb 15 2008 Rex Dieter <rdieter@fedoraproject.org> 7:3.5.9-1
 - kde-3.5.9
 - cleanup conditionals: extras(rhel), modular-x