diff -Naur cups-1.1.20/pdftops/Gfx.cxx cups-1.1.20.new/pdftops/Gfx.cxx
--- cups-1.1.20/pdftops/Gfx.cxx	2003-11-21 22:18:07 +0300
+++ cups-1.1.20.new/pdftops/Gfx.cxx	2004-12-23 13:22:02 +0300
@@ -2381,7 +2381,9 @@
     haveMask = gFalse;
     dict->lookup("Mask", &maskObj);
     if (maskObj.isArray()) {
-      for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+      for (i = 0;
+	   i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+	   ++i) {
 	maskObj.arrayGet(i, &obj1);
 	maskColors[i] = obj1.getInt();
 	obj1.free();
diff -Naur cups-1.1.20/pdftops/GfxState.cxx cups-1.1.20.new/pdftops/GfxState.cxx
--- cups-1.1.20/pdftops/GfxState.cxx	2003-07-20 04:30:54 +0400
+++ cups-1.1.20.new/pdftops/GfxState.cxx	2004-12-23 13:22:02 +0300
@@ -708,6 +708,11 @@
   }
   nCompsA = obj2.getInt();
   obj2.free();
+  if (nCompsA > gfxColorMaxComps) {
+    error(-1, "ICCBased color space with too many (%d > %d) components",
+	  nCompsA, gfxColorMaxComps);
+    nCompsA = gfxColorMaxComps;
+  }
   if (dict->lookup("Alternate", &obj2)->isNull() ||
       !(altA = GfxColorSpace::parse(&obj2))) {
     switch (nCompsA) {