$OpenBSD: patch-splash_SplashXPath_cc,v 1.2 2010/12/04 10:45:21 miod Exp $
--- splash/SplashXPath.cc.orig	Tue Feb 27 22:05:52 2007
+++ splash/SplashXPath.cc	Fri Dec  3 21:16:36 2010
@@ -76,10 +76,26 @@ SplashXPath::SplashXPath(SplashPath *path, SplashCoord
 					    sizeof(SplashXPathAdjust));
     for (i = 0; i < path->hintsLength; ++i) {
       hint = &path->hints[i];
+      if (hint->firstPt >= path->length || hint->lastPt >= path->length) {
+	path->hintsLength = i;
+	if (i == 0) {
+	  gfree(adjusts);
+	  adjusts = NULL;
+	}
+	break;
+      }
       x0 = pts[hint->ctrl0    ].x;    y0 = pts[hint->ctrl0    ].y;
-      x1 = pts[hint->ctrl0 + 1].x;    y1 = pts[hint->ctrl0 + 1].y;
+      if (hint->ctrl0 + 1 >= path->length) {
+	x1 = x0; y1 = y0;
+      } else {
+	x1 = pts[hint->ctrl0 + 1].x;    y1 = pts[hint->ctrl0 + 1].y;
+      }
       x2 = pts[hint->ctrl1    ].x;    y2 = pts[hint->ctrl1    ].y;
-      x3 = pts[hint->ctrl1 + 1].x;    y3 = pts[hint->ctrl1 + 1].y;
+      if (hint->ctrl1 + 1 >= path->length) {
+	x3 = x2; y3 = y2;
+      } else {
+	x3 = pts[hint->ctrl1 + 1].x;    y3 = pts[hint->ctrl1 + 1].y;
+      }
       if (x0 == x1 && x2 == x3) {
 	adjusts[i].vert = gTrue;
 	adj0 = x0;
