Attachment 73668 Details for Bug 56318 – Read 8 byte offsets

[patch] Read 8 byte offsets

0001-Read-8-byte-xref-offsets-when-sizeof-Goffset-8.patch (text/plain), 1.67 KB, created by Adrian Johnson on 2013-01-26 06:26:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adrian Johnson

Created: 2013-01-26 06:26:22 UTC

Size: 1.67 KB

patch

obsolete

>From 7532b5bdb4707faafe4f96ec86fbb9030acfdfaa Mon Sep 17 00:00:00 2001
>From: Adrian Johnson <ajohnson@redneon.com>
>Date: Sat, 26 Jan 2013 16:44:49 +1030
>Subject: [PATCH] Read 8 byte xref offsets when sizeof(Goffset) < 8
>
>and print an error if the offset read is too large for Goffset.
>
>Bug 56318
>---
> poppler/XRef.cc |    9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
>diff --git a/poppler/XRef.cc b/poppler/XRef.cc
>index 1ea0ded..247cdd8 100644
>--- a/poppler/XRef.cc
>+++ b/poppler/XRef.cc
>@@ -40,6 +40,7 @@
> #include <math.h>
> #include <ctype.h>
> #include <limits.h>
>+#include <limits>
> #include <float.h>
> #include "goo/gmem.h"
> #include "Object.h"
>@@ -758,7 +759,7 @@ GBool XRef::readXRefStream(Stream *xrefStr, Goffset *pos) {
>     }
>   }
>   obj.free();
>-  if (w[0] > (int)sizeof(int) || w[1] > (int)sizeof(Goffset) || w[2] > (int)sizeof(int)) {
>+  if (w[0] > (int)sizeof(int) || w[1] > (int)sizeof(long long) || w[2] > (int)sizeof(int)) {
>     goto err1;
>   }
> 
>@@ -817,7 +818,7 @@ GBool XRef::readXRefStream(Stream *xrefStr, Goffset *pos) {
> }
> 
> GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
>-  Goffset offset;
>+  unsigned long long offset;
>   int type, gen, c, i, j;
> 
>   if (first + n < 0) {
>@@ -850,6 +851,10 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
>       }
>       offset = (offset << 8) + c;
>     }
>+    if (offset > (unsigned long long)std::numeric_limits<Goffset>::max()) {
>+      error(errSyntaxError, -1, "Offset inside xref table too large for fseek");
>+      return gFalse;
>+    }
>     for (gen = 0, j = 0; j < w[2]; ++j) {
>       if ((c = xrefStr->getChar()) == EOF) {
> 	return gFalse;
>-- 
>1.7.10.4
>

Actions: View | Splinter Review

Attachments on bug 56318: 68945 | 69219 | 73668

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.