diff --git a/textproc/xpdf/Makefile b/textproc/xpdf/Makefile
index 67c5cb26291..6783ad63842 100644
--- a/textproc/xpdf/Makefile
+++ b/textproc/xpdf/Makefile
@@ -1,9 +1,8 @@
-# $OpenBSD: Makefile,v 1.49 2005/08/31 19:55:37 sturm Exp $
+# $OpenBSD: Makefile,v 1.50 2005/09/09 17:34:53 brad Exp $
 
 COMMENT=	"PDF viewer for X"
 
-DISTNAME=	xpdf-3.00
-PKGNAME=	${DISTNAME}p5
+DISTNAME=	xpdf-3.01
 CATEGORIES=	textproc x11
 
 MASTER_SITES=	ftp://ftp.foolabs.com/pub/xpdf/
diff --git a/textproc/xpdf/distinfo b/textproc/xpdf/distinfo
index ce4e82069f3..6bdbe9f2e96 100644
--- a/textproc/xpdf/distinfo
+++ b/textproc/xpdf/distinfo
@@ -1,4 +1,4 @@
-MD5 (xpdf-3.00.tar.gz) = 95294cef3031dd68e65f331e8750b2c2
-RMD160 (xpdf-3.00.tar.gz) = d98668ac8cd059461107c4dfbd9b3fd3beff6176
-SHA1 (xpdf-3.00.tar.gz) = 080317afce0851274fec2865131f59590b54eb99
-SIZE (xpdf-3.00.tar.gz) = 534697
+MD5 (xpdf-3.01.tar.gz) = e004c69c7dddef165d768b1362b44268
+RMD160 (xpdf-3.01.tar.gz) = d734065ce12db8d0c37d9d0ac0ca7c287be59442
+SHA1 (xpdf-3.01.tar.gz) = 472cbf0f3df4e20a3ab7ada2e704b4e10d1d385b
+SIZE (xpdf-3.01.tar.gz) = 599778
diff --git a/textproc/xpdf/patches/patch-configure_in b/textproc/xpdf/patches/patch-configure_in
deleted file mode 100644
index 5cbc7c21030..00000000000
--- a/textproc/xpdf/patches/patch-configure_in
+++ /dev/null
@@ -1,19 +0,0 @@
-$OpenBSD: patch-configure_in,v 1.1 2004/11/06 18:19:53 naddy Exp $
---- configure.in.orig	Thu Jan 22 02:26:44 2004
-+++ configure.in	Sat Nov  6 17:19:53 2004
-@@ -306,10 +306,13 @@ dnl ##### Check for FreeType 2.x.
- dnl ##### (Note: FT_Get_Name_Index was added in FT 2.0.5, and is
- dnl ##### the reason that Xpdf requires 2.0.5+.)
- smr_CHECK_LIB(freetype2, freetype, [FreeType2 font rasterizer - version 2.0.5+],
--              FT_Get_Name_Index, freetype/freetype.h, -lm)
-+              FT_Get_Name_Index, freetype/ft2build.h, -lm)
- if test x"$freetype2_LIBS" = x; then
-   smr_CHECK_LIB(freetype2, freetype, [FreeType2 font rasterizer - version 2.0.5+],
--                FT_Get_Name_Index, freetype.h, -lm)
-+                FT_Get_Name_Index, ft2build.h, -lm)
-+  if test "x$smr_have_freetype2_library" = xyes; then
-+    AC_DEFINE(HAVE_FREETYPE_H)
-+  fi
- fi
- AC_SUBST(freetype2_LIBS)
- AC_SUBST(freetype2_CFLAGS)
diff --git a/textproc/xpdf/patches/patch-doc_sample-xpdfrc b/textproc/xpdf/patches/patch-doc_sample-xpdfrc
index 33ac2eef408..bff33c5c779 100644
--- a/textproc/xpdf/patches/patch-doc_sample-xpdfrc
+++ b/textproc/xpdf/patches/patch-doc_sample-xpdfrc
@@ -1,7 +1,7 @@
-$OpenBSD: patch-doc_sample-xpdfrc,v 1.1 2004/04/06 02:35:44 brad Exp $
---- doc/sample-xpdfrc.orig	2004-04-04 16:21:43.000000000 +0200
-+++ doc/sample-xpdfrc	2004-04-04 16:22:02.000000000 +0200
-@@ -73,7 +73,7 @@
+$OpenBSD: patch-doc_sample-xpdfrc,v 1.2 2005/09/09 17:34:53 brad Exp $
+--- doc/sample-xpdfrc.orig	Wed Aug 17 07:34:30 2005
++++ doc/sample-xpdfrc	Thu Aug 18 10:08:25 2005
+@@ -56,7 +56,7 @@
  
  # Set the default PostScript file or command.
  
diff --git a/textproc/xpdf/patches/patch-fofi_FoFiTrueType_cc b/textproc/xpdf/patches/patch-fofi_FoFiTrueType_cc
deleted file mode 100644
index 6594e61ae6b..00000000000
--- a/textproc/xpdf/patches/patch-fofi_FoFiTrueType_cc
+++ /dev/null
@@ -1,31 +0,0 @@
-$OpenBSD: patch-fofi_FoFiTrueType_cc,v 1.1 2005/08/11 14:18:47 naddy Exp $
---- fofi/FoFiTrueType.cc.orig	Thu Jan 22 02:26:44 2004
-+++ fofi/FoFiTrueType.cc	Wed Aug 10 22:25:23 2005
-@@ -1343,6 +1343,27 @@ void FoFiTrueType::parse() {
-     return;
-   }
- 
-+  // make sure the loca table is sane (correct length and entries are
-+  // in bounds)
-+  i = seekTable("loca");
-+  if (tables[i].len < (nGlyphs + 1) * (locaFmt ? 4 : 2)) {
-+    parsedOk = gFalse;
-+    return;
-+  }
-+  for (j = 0; j <= nGlyphs; ++j) {
-+    if (locaFmt) {
-+      pos = (int)getU32BE(tables[i].offset + j*4, &parsedOk);
-+    } else {
-+      pos = getU16BE(tables[i].offset + j*2, &parsedOk);
-+    }
-+    if (pos < 0 || pos > len) {
-+      parsedOk = gFalse;
-+    }
-+  }
-+  if (!parsedOk) {
-+    return;
-+  }
-+
-   // read the post table
-   readPostTable();
-   if (!parsedOk) {
diff --git a/textproc/xpdf/patches/patch-splash_SplashFTFontEngine_h b/textproc/xpdf/patches/patch-splash_SplashFTFontEngine_h
deleted file mode 100644
index e1bc9f07515..00000000000
--- a/textproc/xpdf/patches/patch-splash_SplashFTFontEngine_h
+++ /dev/null
@@ -1,13 +0,0 @@
-$OpenBSD: patch-splash_SplashFTFontEngine_h,v 1.1 2004/11/06 18:19:53 naddy Exp $
---- splash/SplashFTFontEngine.h.orig	Sat Nov  6 18:11:44 2004
-+++ splash/SplashFTFontEngine.h	Sat Nov  6 18:12:10 2004
-@@ -15,7 +15,8 @@
- #pragma interface
- #endif
- 
--#include <freetype/freetype.h>
-+#include <ft2build.h>
-+#include FT_FREETYPE_H
- #include "gtypes.h"
- 
- class SplashFontFile;
diff --git a/textproc/xpdf/patches/patch-splash_SplashFTFontFile_h b/textproc/xpdf/patches/patch-splash_SplashFTFontFile_h
deleted file mode 100644
index f4e105b7598..00000000000
--- a/textproc/xpdf/patches/patch-splash_SplashFTFontFile_h
+++ /dev/null
@@ -1,13 +0,0 @@
-$OpenBSD: patch-splash_SplashFTFontFile_h,v 1.1 2004/11/06 18:19:53 naddy Exp $
---- splash/SplashFTFontFile.h.orig	Sat Nov  6 18:11:50 2004
-+++ splash/SplashFTFontFile.h	Sat Nov  6 18:12:43 2004
-@@ -15,7 +15,8 @@
- #pragma interface
- #endif
- 
--#include <freetype/freetype.h>
-+#include <ft2build.h>
-+#include FT_FREETYPE_H
- #include "SplashFontFile.h"
- 
- class SplashFontFileID;
diff --git a/textproc/xpdf/patches/patch-splash_SplashFTFont_h b/textproc/xpdf/patches/patch-splash_SplashFTFont_h
deleted file mode 100644
index c42cb738fef..00000000000
--- a/textproc/xpdf/patches/patch-splash_SplashFTFont_h
+++ /dev/null
@@ -1,13 +0,0 @@
-$OpenBSD: patch-splash_SplashFTFont_h,v 1.1 2004/11/06 18:19:53 naddy Exp $
---- splash/SplashFTFont.h.orig	Sat Nov  6 18:11:08 2004
-+++ splash/SplashFTFont.h	Sat Nov  6 18:11:30 2004
-@@ -15,7 +15,8 @@
- #pragma interface
- #endif
- 
--#include <freetype/freetype.h>
-+#include <ft2build.h>
-+#include FT_FREETYPE_H
- #include "SplashFont.h"
- 
- class SplashFTFontFile;
diff --git a/textproc/xpdf/patches/patch-xpdf_Catalog_cc b/textproc/xpdf/patches/patch-xpdf_Catalog_cc
index fcfd15ea431..5f1cacf825a 100644
--- a/textproc/xpdf/patches/patch-xpdf_Catalog_cc
+++ b/textproc/xpdf/patches/patch-xpdf_Catalog_cc
@@ -1,6 +1,6 @@
-$OpenBSD: patch-xpdf_Catalog_cc,v 1.1 2004/10/23 02:24:37 brad Exp $
---- xpdf/Catalog.cc.orig	Wed Jan 21 20:26:45 2004
-+++ xpdf/Catalog.cc	Fri Oct 22 21:54:48 2004
+$OpenBSD: patch-xpdf_Catalog_cc,v 1.2 2005/09/09 17:34:53 brad Exp $
+--- xpdf/Catalog.cc.orig	Wed Aug 17 07:34:31 2005
++++ xpdf/Catalog.cc	Thu Aug 18 10:15:28 2005
 @@ -64,6 +64,15 @@ Catalog::Catalog(XRef *xrefA) {
    }
    pagesSize = numPages0 = (int)obj.getNum();
@@ -14,18 +14,18 @@ $OpenBSD: patch-xpdf_Catalog_cc,v 1.1 2004/10/23 02:24:37 brad Exp $
 +    return;
 +  }
 +
-   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
-   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+   pages = (Page **)gmallocn(pagesSize, sizeof(Page *));
+   pageRefs = (Ref *)gmallocn(pagesSize, sizeof(Ref));
    for (i = 0; i < pagesSize; ++i) {
-@@ -191,6 +200,11 @@ int Catalog::readPageTree(Dict *pagesDic
+@@ -195,6 +204,11 @@ int Catalog::readPageTree(Dict *pagesDic
        }
        if (start >= pagesSize) {
  	pagesSize += 32;
-+        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
-+		pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
-+          error(-1, "Invalid 'pagesSize' parameter.");
-+          goto err3;
-+        }
- 	pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
- 	pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
++         if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++                pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++           error(-1, "Invalid 'pagesSize' parameter.");
++           goto err3;
++         }
+ 	pages = (Page **)greallocn(pages, pagesSize, sizeof(Page *));
+ 	pageRefs = (Ref *)greallocn(pageRefs, pagesSize, sizeof(Ref));
  	for (j = pagesSize - 32; j < pagesSize; ++j) {
diff --git a/textproc/xpdf/patches/patch-xpdf_GfxState_cc b/textproc/xpdf/patches/patch-xpdf_GfxState_cc
deleted file mode 100644
index 163697cd6ba..00000000000
--- a/textproc/xpdf/patches/patch-xpdf_GfxState_cc
+++ /dev/null
@@ -1,24 +0,0 @@
-$OpenBSD: patch-xpdf_GfxState_cc,v 1.5 2005/08/10 20:27:25 naddy Exp $
---- xpdf/GfxState.cc.orig	Thu Jan 22 02:26:45 2004
-+++ xpdf/GfxState.cc	Wed Aug 10 22:27:55 2005
-@@ -708,6 +708,11 @@ GfxColorSpace *GfxICCBasedColorSpace::pa
-   }
-   nCompsA = obj2.getInt();
-   obj2.free();
-+  if (nCompsA > gfxColorMaxComps) {
-+    error(-1, "ICCBased color space with too many (%d > %d) components",
-+	  nCompsA, gfxColorMaxComps);
-+    nCompsA = gfxColorMaxComps;
-+  }
-   if (dict->lookup("Alternate", &obj2)->isNull() ||
-       !(altA = GfxColorSpace::parse(&obj2))) {
-     switch (nCompsA) {
-@@ -1054,7 +1059,7 @@ GfxColorSpace *GfxDeviceNColorSpace::par
-   }
-   nCompsA = obj1.arrayGetLength();
-   if (nCompsA > gfxColorMaxComps) {
--    error(-1, "DeviceN color space with more than %d > %d components",
-+    error(-1, "DeviceN color space with too many (%d > %d) components",
- 	  nCompsA, gfxColorMaxComps);
-     nCompsA = gfxColorMaxComps;
-   }
diff --git a/textproc/xpdf/patches/patch-xpdf_Gfx_cc b/textproc/xpdf/patches/patch-xpdf_Gfx_cc
deleted file mode 100644
index 33f269ac248..00000000000
--- a/textproc/xpdf/patches/patch-xpdf_Gfx_cc
+++ /dev/null
@@ -1,14 +0,0 @@
-$OpenBSD: patch-xpdf_Gfx_cc,v 1.2 2005/08/10 20:27:25 naddy Exp $
---- xpdf/Gfx.cc.orig	Thu Jan 22 02:26:45 2004
-+++ xpdf/Gfx.cc	Wed Aug 10 22:27:55 2005
-@@ -2654,7 +2654,9 @@ void Gfx::doImage(Object *ref, Stream *s
-     haveMask = gFalse;
-     dict->lookup("Mask", &maskObj);
-     if (maskObj.isArray()) {
--      for (i = 0; i < maskObj.arrayGetLength(); ++i) {
-+      for (i = 0;
-+	   i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
-+	   ++i) {
- 	maskObj.arrayGet(i, &obj1);
- 	maskColors[i] = obj1.getInt();
- 	obj1.free();
diff --git a/textproc/xpdf/patches/patch-xpdf_SplashOutputDev_cc b/textproc/xpdf/patches/patch-xpdf_SplashOutputDev_cc
deleted file mode 100644
index 3692d0c3251..00000000000
--- a/textproc/xpdf/patches/patch-xpdf_SplashOutputDev_cc
+++ /dev/null
@@ -1,28 +0,0 @@
-$OpenBSD: patch-xpdf_SplashOutputDev_cc,v 1.1 2005/08/11 14:18:47 naddy Exp $
---- xpdf/SplashOutputDev.cc.orig	Thu Jan 22 02:26:45 2004
-+++ xpdf/SplashOutputDev.cc	Wed Aug 10 22:25:23 2005
-@@ -621,16 +621,19 @@ void SplashOutputDev::updateFont(GfxStat
-       }
-       break;
-     case fontTrueType:
--      if (!(ff = FoFiTrueType::load(fileName->getCString()))) {
--	goto err2;
-+      if ((ff = FoFiTrueType::load(fileName->getCString()))) {
-+	codeToGID = ((Gfx8BitFont *)gfxFont)->getCodeToGIDMap(ff);
-+	n = 256;
-+	delete ff;
-+      } else {
-+	codeToGID = NULL;
-+	n = 0;
-       }
--      codeToGID = ((Gfx8BitFont *)gfxFont)->getCodeToGIDMap(ff);
--      delete ff;
-       if (!(fontFile = fontEngine->loadTrueTypeFont(
- 			   id,
- 			   fileName->getCString(),
- 			   fileName == tmpFileName,
--			   codeToGID, 256))) {
-+			   codeToGID, n))) {
- 	error(-1, "Couldn't create a font for '%s'",
- 	      gfxFont->getName() ? gfxFont->getName()->getCString()
- 	                         : "(unnamed)");
diff --git a/textproc/xpdf/patches/patch-xpdf_XPDFCore_cc b/textproc/xpdf/patches/patch-xpdf_XPDFCore_cc
index ab10a757532..b5138677576 100644
--- a/textproc/xpdf/patches/patch-xpdf_XPDFCore_cc
+++ b/textproc/xpdf/patches/patch-xpdf_XPDFCore_cc
@@ -1,40 +1,20 @@
-$OpenBSD: patch-xpdf_XPDFCore_cc,v 1.2 2004/01/25 06:02:40 brad Exp $
---- xpdf/XPDFCore.cc.orig	2004-01-21 20:26:45.000000000 -0500
-+++ xpdf/XPDFCore.cc	2004-01-24 23:34:15.000000000 -0500
-@@ -940,9 +940,6 @@ void XPDFCore::moveSelection(int mx, int
- // global variables (currentSelection and currentSelectionOwner).
+$OpenBSD: patch-xpdf_XPDFCore_cc,v 1.3 2005/09/09 17:34:53 brad Exp $
+--- xpdf/XPDFCore.cc.orig	Wed Aug 17 07:34:31 2005
++++ xpdf/XPDFCore.cc	Thu Aug 18 10:23:14 2005
+@@ -377,9 +377,6 @@ void XPDFCore::copySelection() {
+   int pg;
+   double ulx, uly, lrx, lry;
  
- void XPDFCore::copySelection() {
 -  if (!doc->okToCopy()) {
 -    return;
 -  }
-   if (currentSelection) {
-     delete currentSelection;
-   }
-@@ -997,9 +994,6 @@ GBool XPDFCore::getSelection(int *xMin, 
- }
- 
- GString *XPDFCore::extractText(int xMin, int yMin, int xMax, int yMax) {
--  if (!doc->okToCopy()) {
--    return NULL;
--  }
-   return out->getText(xMin, yMin, xMax, yMax);
- }
- 
-@@ -1008,9 +1002,6 @@ GString *XPDFCore::extractText(int pageN
-   TextOutputDev *textOut;
-   GString *s;
- 
--  if (!doc->okToCopy()) {
--    return NULL;
--  }
-   textOut = new TextOutputDev(NULL, gTrue, gFalse, gFalse);
-   if (!textOut->isOk()) {
-     delete textOut;
-@@ -1649,11 +1640,7 @@ void XPDFCore::inputCbk(Widget widget, X
+   if (getSelection(&pg, &ulx, &uly, &lrx, &lry)) {
+     //~ for multithreading: need a mutex here
+     if (currentSelection) {
+@@ -1108,11 +1105,7 @@ void XPDFCore::inputCbk(Widget widget, X
  #ifndef NO_TEXT_SELECT
- 	  if (core->selectXMin != core->selectXMax &&
- 	      core->selectYMin != core->selectYMax) {
+ 	  if (core->selectULX != core->selectLRX &&
+ 	      core->selectULY != core->selectLRY) {
 -	    if (core->doc->okToCopy()) {
  	      core->copySelection();
 -	    } else {
diff --git a/textproc/xpdf/patches/patch-xpdf_XPDFViewer_cc b/textproc/xpdf/patches/patch-xpdf_XPDFViewer_cc
index 4b33bd2b0dc..12d872f625d 100644
--- a/textproc/xpdf/patches/patch-xpdf_XPDFViewer_cc
+++ b/textproc/xpdf/patches/patch-xpdf_XPDFViewer_cc
@@ -1,7 +1,7 @@
-$OpenBSD: patch-xpdf_XPDFViewer_cc,v 1.2 2004/01/25 06:02:40 brad Exp $
---- xpdf/XPDFViewer.cc.orig	2004-01-21 20:26:45.000000000 -0500
-+++ xpdf/XPDFViewer.cc	2004-01-24 23:34:15.000000000 -0500
-@@ -2285,11 +2285,6 @@ void XPDFViewer::printPrintCbk(Widget wi
+$OpenBSD: patch-xpdf_XPDFViewer_cc,v 1.3 2005/09/09 17:34:53 brad Exp $
+--- xpdf/XPDFViewer.cc.orig	Wed Aug 17 07:34:31 2005
++++ xpdf/XPDFViewer.cc	Thu Aug 18 10:08:25 2005
+@@ -2391,11 +2391,6 @@ void XPDFViewer::printPrintCbk(Widget wi
    PSOutputDev *psOut;
  
    doc = viewer->core->getDoc();
diff --git a/textproc/xpdf/patches/patch-xpdf_XRef_cc b/textproc/xpdf/patches/patch-xpdf_XRef_cc
deleted file mode 100644
index b14d7b1d708..00000000000
--- a/textproc/xpdf/patches/patch-xpdf_XRef_cc
+++ /dev/null
@@ -1,276 +0,0 @@
-$OpenBSD: patch-xpdf_XRef_cc,v 1.2 2005/01/19 16:23:16 naddy Exp $
---- xpdf/XRef.cc.orig	Thu Jan 22 02:26:45 2004
-+++ xpdf/XRef.cc	Wed Jan 19 14:23:39 2005
-@@ -96,7 +96,7 @@ ObjectStream::ObjectStream(XRef *xref, i
-   }
-   nObjects = obj1.getInt();
-   obj1.free();
--  if (nObjects == 0) {
-+  if (nObjects <= 0) {
-     goto err1;
-   }
- 
-@@ -106,7 +106,14 @@ ObjectStream::ObjectStream(XRef *xref, i
-   }
-   first = obj1.getInt();
-   obj1.free();
-+  if (first < 0) {
-+    goto err1;
-+  }
- 
-+  if (nObjects*sizeof(int)/sizeof(int) != nObjects) {
-+    error(-1, "Invalid 'nObjects'");
-+    goto err1;
-+  }
-   objs = new Object[nObjects];
-   objNums = (int *)gmalloc(nObjects * sizeof(int));
-   offsets = (int *)gmalloc(nObjects * sizeof(int));
-@@ -130,6 +137,12 @@ ObjectStream::ObjectStream(XRef *xref, i
-     offsets[i] = obj2.getInt();
-     obj1.free();
-     obj2.free();
-+    if (objNums[i] < 0 || offsets[i] < 0 ||
-+	(i > 0 && offsets[i] < offsets[i-1])) {
-+      delete parser;
-+      gfree(offsets);
-+      goto err1;
-+    }
-   }
-   while (str->getChar() != EOF) ;
-   delete parser;
-@@ -369,10 +382,20 @@ GBool XRef::readXRefTable(Parser *parser
-     }
-     n = obj.getInt();
-     obj.free();
-+    if (first < 0 || n < 0 || first + n < 0) {
-+      goto err1;
-+    }
-     if (first + n > size) {
-       for (newSize = size ? 2 * size : 1024;
--	   first + n > newSize;
-+	   first + n > newSize && newSize > 0;
- 	   newSize <<= 1) ;
-+      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
-+	error(-1, "Invalid 'obj' parameters'");
-+	return gFalse;
-+      }
-+      if (newSize < 0) {
-+	goto err1;
-+      }
-       entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
-       for (i = size; i < newSize; ++i) {
- 	entries[i].offset = 0xffffffff;
-@@ -443,7 +466,7 @@ GBool XRef::readXRefTable(Parser *parser
- 
-   // check for an 'XRefStm' key
-   if (obj.getDict()->lookup("XRefStm", &obj2)->isInt()) {
--    pos2 = obj2.getInt();
-+    pos2 = (Guint)obj2.getInt();
-     readXRef(&pos2);
-     if (!ok) {
-       goto err1;
-@@ -474,7 +497,14 @@ GBool XRef::readXRefStream(Stream *xrefS
-   }
-   newSize = obj.getInt();
-   obj.free();
-+  if (newSize < 0) {
-+    goto err1;
-+  }
-   if (newSize > size) {
-+    if (newSize * sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
-+      error(-1, "Invalid 'size' parameter.");
-+      return gFalse;
-+    }
-     entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
-     for (i = size; i < newSize; ++i) {
-       entries[i].offset = 0xffffffff;
-@@ -494,6 +524,9 @@ GBool XRef::readXRefStream(Stream *xrefS
-     }
-     w[i] = obj2.getInt();
-     obj2.free();
-+    if (w[i] < 0 || w[i] > 4) {
-+      goto err1;
-+    }
-   }
-   obj.free();
- 
-@@ -513,13 +546,14 @@ GBool XRef::readXRefStream(Stream *xrefS
-       }
-       n = obj.getInt();
-       obj.free();
--      if (!readXRefStreamSection(xrefStr, w, first, n)) {
-+      if (first < 0 || n < 0 ||
-+	  !readXRefStreamSection(xrefStr, w, first, n)) {
- 	idx.free();
- 	goto err0;
-       }
-     }
-   } else {
--    if (!readXRefStreamSection(xrefStr, w, 0, size)) {
-+    if (!readXRefStreamSection(xrefStr, w, 0, newSize)) {
-       idx.free();
-       goto err0;
-     }
-@@ -551,10 +585,20 @@ GBool XRef::readXRefStreamSection(Stream
-   Guint offset;
-   int type, gen, c, newSize, i, j;
- 
-+  if (first + n < 0) {
-+    return gFalse;
-+  }
-   if (first + n > size) {
-     for (newSize = size ? 2 * size : 1024;
--	 first + n > newSize;
-+	 first + n > newSize && newSize > 0;
- 	 newSize <<= 1) ;
-+    if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
-+      error(-1, "Invalid 'size' inside xref table.");
-+      return gFalse;
-+    }	
-+    if (newSize < 0) {
-+      return gFalse;
-+    }
-     entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
-     for (i = size; i < newSize; ++i) {
-       entries[i].offset = 0xffffffff;
-@@ -585,24 +629,26 @@ GBool XRef::readXRefStreamSection(Stream
-       }
-       gen = (gen << 8) + c;
-     }
--    switch (type) {
--    case 0:
--      entries[i].offset = offset;
--      entries[i].gen = gen;
--      entries[i].type = xrefEntryFree;
--      break;
--    case 1:
--      entries[i].offset = offset;
--      entries[i].gen = gen;
--      entries[i].type = xrefEntryUncompressed;
--      break;
--    case 2:
--      entries[i].offset = offset;
--      entries[i].gen = gen;
--      entries[i].type = xrefEntryCompressed;
--      break;
--    default:
--      return gFalse;
-+    if (entries[i].offset == 0xffffffff) {
-+      switch (type) {
-+      case 0:
-+	entries[i].offset = offset;
-+	entries[i].gen = gen;
-+	entries[i].type = xrefEntryFree;
-+	break;
-+      case 1:
-+	entries[i].offset = offset;
-+	entries[i].gen = gen;
-+	entries[i].type = xrefEntryUncompressed;
-+	break;
-+      case 2:
-+	entries[i].offset = offset;
-+	entries[i].gen = gen;
-+	entries[i].type = xrefEntryCompressed;
-+	break;
-+      default:
-+	return gFalse;
-+      }
-     }
-   }
- 
-@@ -664,39 +710,49 @@ GBool XRef::constructXRef() {
-     // look for object
-     } else if (isdigit(*p)) {
-       num = atoi(p);
--      do {
--	++p;
--      } while (*p && isdigit(*p));
--      if (isspace(*p)) {
-+      if (num > 0) {
- 	do {
- 	  ++p;
--	} while (*p && isspace(*p));
--	if (isdigit(*p)) {
--	  gen = atoi(p);
-+	} while (*p && isdigit(*p));
-+	if (isspace(*p)) {
- 	  do {
- 	    ++p;
--	  } while (*p && isdigit(*p));
--	  if (isspace(*p)) {
-+	  } while (*p && isspace(*p));
-+	  if (isdigit(*p)) {
-+	    gen = atoi(p);
- 	    do {
- 	      ++p;
--	    } while (*p && isspace(*p));
--	    if (!strncmp(p, "obj", 3)) {
--	      if (num >= size) {
--		newSize = (num + 1 + 255) & ~255;
--		entries = (XRefEntry *)
--		            grealloc(entries, newSize * sizeof(XRefEntry));
--		for (i = size; i < newSize; ++i) {
--		  entries[i].offset = 0xffffffff;
--		  entries[i].type = xrefEntryFree;
-+	    } while (*p && isdigit(*p));
-+	    if (isspace(*p)) {
-+	      do {
-+		++p;
-+	      } while (*p && isspace(*p));
-+	      if (!strncmp(p, "obj", 3)) {
-+		if (num >= size) {
-+		  newSize = (num + 1 + 255) & ~255;
-+		  if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
-+		    error(-1, "Invalid 'obj' parameters.");
-+		    return gFalse;
-+		  }
-+		  if (newSize < 0) {
-+		    error(-1, "Bad object number");
-+		    return gFalse;
-+		  }
-+		  entries = (XRefEntry *)
-+		      grealloc(entries, newSize * sizeof(XRefEntry));
-+		  for (i = size; i < newSize; ++i) {
-+		    entries[i].offset = 0xffffffff;
-+		    entries[i].type = xrefEntryFree;
-+		  }
-+		  size = newSize;
- 		}
--		size = newSize;
-+		if (entries[num].type == xrefEntryFree ||
-+		    gen >= entries[num].gen) {
-+		  entries[num].offset = pos - start;
-+		  entries[num].gen = gen;
-+		  entries[num].type = xrefEntryUncompressed;
-+		}
- 	      }
--	      if (entries[num].type == xrefEntryFree ||
--		  gen >= entries[num].gen) {
--		entries[num].offset = pos - start;
--		entries[num].gen = gen;
--		entries[num].type = xrefEntryUncompressed;
--	      }
- 	    }
- 	  }
- 	}
-@@ -705,6 +761,10 @@ GBool XRef::constructXRef() {
-     } else if (!strncmp(p, "endstream", 9)) {
-       if (streamEndsLen == streamEndsSize) {
- 	streamEndsSize += 64;
-+        if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
-+          error(-1, "Invalid 'endstream' parameter.");
-+          return gFalse;
-+        }
- 	streamEnds = (Guint *)grealloc(streamEnds,
- 				       streamEndsSize * sizeof(int));
-       }
-@@ -756,6 +816,9 @@ GBool XRef::checkEncrypted(GString *owne
- 	  keyLength = lengthObj.getInt() / 8;
- 	} else {
- 	  keyLength = 5;
-+	}
-+	if (keyLength > 16) {
-+	  keyLength = 16;
- 	}
- 	permFlags = permissions.getInt();
- 	if (encVersion >= 1 && encVersion <= 2 &&
diff --git a/textproc/xpdf/patches/patch-xpdf_pdftops_cc b/textproc/xpdf/patches/patch-xpdf_pdftops_cc
index af0c18d3b5f..15af0ad95e7 100644
--- a/textproc/xpdf/patches/patch-xpdf_pdftops_cc
+++ b/textproc/xpdf/patches/patch-xpdf_pdftops_cc
@@ -1,7 +1,7 @@
-$OpenBSD: patch-xpdf_pdftops_cc,v 1.2 2004/01/25 06:02:40 brad Exp $
---- xpdf/pdftops.cc.orig	2004-01-21 20:26:45.000000000 -0500
-+++ xpdf/pdftops.cc	2004-01-24 23:34:15.000000000 -0500
-@@ -266,13 +266,6 @@ int main(int argc, char *argv[]) {
+$OpenBSD: patch-xpdf_pdftops_cc,v 1.3 2005/09/09 17:34:53 brad Exp $
+--- xpdf/pdftops.cc.orig	Wed Aug 17 07:34:31 2005
++++ xpdf/pdftops.cc	Thu Aug 18 10:08:26 2005
+@@ -269,13 +269,6 @@ int main(int argc, char *argv[]) {
      goto err1;
    }