diff options
| author | Tor Andersson <tor@ghostscript.com> | 2010-06-15 01:30:07 +0200 |
|---|---|---|
| committer | Tor Andersson <tor@ghostscript.com> | 2010-06-15 01:30:07 +0200 |
| commit | 0f9722d6a9351b4a89a1ce27dcd7173db87a74ef (patch) | |
| tree | 1bbc91c1e48cc1424d0c215d8070bb388e68c87e | |
| parent | e1ebc141e894b99a8f1b98eb8bc4b31b2c722918 (diff) | |
| download | mupdf-0f9722d6a9351b4a89a1ce27dcd7173db87a74ef.tar.xz | |
Seek to the indicated offsets when loading objects in a compressed object stream. This will safeguard against invalid PDF files that embed sub-streams in compressed object streams.
| -rw-r--r-- | mupdf/pdf_xref.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/mupdf/pdf_xref.c b/mupdf/pdf_xref.c index b1908702..c55c2feb 100644 --- a/mupdf/pdf_xref.c +++ b/mupdf/pdf_xref.c @@ -61,10 +61,10 @@ pdf_debugxref(pdf_xref *xref) printf("xref\n0 %d\n", xref->len); for (i = 0; i < xref->len; i++) { - printf("%010d %05d %c (ref=%d, ofs=%d)\n", + printf("%05d: %010d %05d %c (refs=%d, stmofs=%d)\n", i, xref->table[i].ofs, xref->table[i].gen, - xref->table[i].type, + xref->table[i].type ? xref->table[i].type : '-', xref->table[i].obj ? xref->table[i].obj->refs : 0, xref->table[i].stmofs); } @@ -138,7 +138,12 @@ pdf_loadobjstm(pdf_xref *xref, int num, int gen, char *buf, int cap) for (i = 0; i < count; i++) { - /* FIXME: seek to first + ofsbuf[i] */ + error = fz_seek(stm, first + ofsbuf[i], 0); + if (error) + { + error = fz_rethrow(error, "cannot seek in object stream (%d %d R)", num, gen); + goto cleanupstm; + } error = pdf_parsestmobj(&obj, xref, stm, buf, cap); if (error) |