diff options
author | Tor Andersson <tor.andersson@artifex.com> | 2014-05-05 13:03:47 +0200 |
---|---|---|
committer | Tor Andersson <tor.andersson@artifex.com> | 2014-05-05 13:48:14 +0200 |
commit | 68e0819c1ad2475e822825e8510a7bd9d0420d61 (patch) | |
tree | a1f5b4d479505a3bf0d6b7941873846f954878a1 | |
parent | 92a67fc9c93e7820a96f9ae188c67584831a9269 (diff) | |
download | mupdf-68e0819c1ad2475e822825e8510a7bd9d0420d61.tar.xz |
Fix 695098: don't use atoi() on non-zero-terminated buffer.
-rw-r--r-- | source/pdf/pdf-xref.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 9bf735da..134d72cc 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -323,9 +323,11 @@ pdf_read_start_xref(pdf_document *doc) if (memcmp(buf + i, "startxref", 9) == 0) { i += 9; - while (iswhite(buf[i]) && i < n) + while (i < n && iswhite(buf[i])) i ++; - doc->startxref = atoi((char*)(buf + i)); + doc->startxref = 0; + while (i < n && buf[i] >= '0' && buf[i] <= '9') + doc->startxref = doc->startxref * 10 + (buf[i++] - '0'); if (doc->startxref != 0) return; break; |