Attachment 108115 Details for Bug 85234 – fix crash

[patch] fix crash

0001-fix-crash-in-Xref-getEntry.patch (text/plain), 1.34 KB, created by Adrian Johnson on 2014-10-20 12:16:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adrian Johnson

Created: 2014-10-20 12:16:27 UTC

Size: 1.34 KB

patch

obsolete

>From 2d5ed35963d977f57ccbcdfe2bd4aa0bdb24aec1 Mon Sep 17 00:00:00 2001
>From: Adrian Johnson <ajohnson@redneon.com>
>Date: Mon, 20 Oct 2014 22:44:23 +1030
>Subject: [PATCH] fix crash in Xref::getEntry
>
>Bug 85234
>---
> poppler/XRef.cc | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/poppler/XRef.cc b/poppler/XRef.cc
>index 2560e3d..333f5ec 100644
>--- a/poppler/XRef.cc
>+++ b/poppler/XRef.cc
>@@ -1568,7 +1568,7 @@ GBool XRef::parseEntry(Goffset offset, XRefEntry *entry)
> void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
> {
>   std::vector<Goffset> followedPrev;
>-  while (prevXRefOffset && (untilEntryNum == -1 || entries[untilEntryNum].type == xrefEntryNone)) {
>+  while (prevXRefOffset && (untilEntryNum == -1 || (untilEntryNum < size && entries[untilEntryNum].type == xrefEntryNone))) {
>     bool followed = false;
>     for (size_t j = 0; j < followedPrev.size(); j++) {
>       if (followedPrev.at(j) == prevXRefOffset) {
>@@ -1606,7 +1606,7 @@ void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
> 
> XRefEntry *XRef::getEntry(int i, GBool complainIfMissing)
> {
>-  if (entries[i].type == xrefEntryNone) {
>+  if (i >= size || entries[i].type == xrefEntryNone) {
> 
>     if ((!xRefStream) && mainXRefEntriesOffset) {
>       if (!parseEntry(mainXRefEntriesOffset + 20*i, &entries[i])) {
>-- 
>2.1.1
>

Actions: View | Splinter Review

Attachments on bug 85234: 108109 | 108115

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.