Attachment 135666 Details for Bug 103469 – New patch

[patch] New patch

103469.patch (text/plain), 1.12 KB, created by Albert Astals Cid on 2017-11-22 16:03:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Albert Astals Cid

Created: 2017-11-22 16:03:11 UTC

Size: 1.12 KB

patch

obsolete

>diff --git a/poppler/XRef.cc b/poppler/XRef.cc
>index e37d5494..f04a31fc 100644
>--- a/poppler/XRef.cc
>+++ b/poppler/XRef.cc
>@@ -734,7 +734,7 @@ GBool XRef::readXRefStream(Stream *xrefStr, Goffset *pos) {
>       return gFalse;
>     }
>   }
>-  if (w[0] > (int)sizeof(int) || w[1] > (int)sizeof(long long) || w[2] > (int)sizeof(int)) {
>+  if (w[0] > (int)sizeof(int) || w[1] > (int)sizeof(long long) || w[2] > (int)sizeof(long long)) {
>     return gFalse;
>   }
> 
>@@ -782,8 +782,8 @@ GBool XRef::readXRefStream(Stream *xrefStr, Goffset *pos) {
> }
> 
> GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
>-  unsigned long long offset;
>-  int type, gen, c, i, j;
>+  unsigned long long offset, gen;
>+  int type, c, i, j;
> 
>   if (first + n < 0) {
>     return gFalse;
>@@ -825,6 +825,10 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
>       }
>       gen = (gen << 8) + c;
>     }
>+    if (gen > INT_MAX) {
>+      error(errSyntaxError, -1, "Gen inside xref table too large (bigger than INT_MAX)");
>+      return gFalse;
>+    }
>     if (entries[i].offset == -1) {
>       switch (type) {
>       case 0:

Actions: View | Splinter Review

Attachments on bug 103469: 135069 | 135070 | 135172 | 135666

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.