diff options
| author | Robin Watts <robin.watts@artifex.com> | 2013-01-04 16:19:02 +0000 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2013-01-11 15:34:07 +0000 |
| commit | 5ee271fd9c8b51b65d3e62a1eb47971adc090328 (patch) | |
| tree | 39fed8e4e3fbd10b5c13b6549e76ad844b7eab42 /fitz/fitz-internal.h | |
| parent | 575d606b8ee1b1cac02be42ba237f1f959d419d8 (diff) | |
| download | mupdf-5ee271fd9c8b51b65d3e62a1eb47971adc090328.tar.xz | |
Bug 693503: Fix NULL dereference in atoi.
If a PDF xref subsection is broken in the wrong place, we can get
NULL back from fz_strsep, which causes a SEGV when fed to atoi.
Add a new fz_atoi that copes with NULL to avoid this.
Problem found in a test file, 3959.pdf.SIGSEGV.ad4.3289 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!
Diffstat (limited to 'fitz/fitz-internal.h')
| -rw-r--r-- | fitz/fitz-internal.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fitz/fitz-internal.h b/fitz/fitz-internal.h index 58b77c94..e853188d 100644 --- a/fitz/fitz-internal.h +++ b/fitz/fitz-internal.h @@ -247,6 +247,9 @@ static inline float my_atan2f(float o, float a) /* Range checking atof */ float fz_atof(const char *s); +/* atoi that copes with NULL */ +int fz_atoi(const char *s); + /* * Generic hash-table with fixed-length keys. */ |