diff options
author | Tor Andersson <tor.andersson@artifex.com> | 2011-09-06 12:41:44 +0200 |
---|---|---|
committer | Tor Andersson <tor.andersson@artifex.com> | 2011-09-06 12:41:44 +0200 |
commit | 0cdc74747cd941b5879a4d2de6c7a71a9b99a23b (patch) | |
tree | 9e936fcd50e0b4e57bf759804af7f306439de2fa /pdf/pdf_parse.c | |
parent | dfa8e0ef2e2a6440d018cc35b1120e57b5697fec (diff) | |
download | mupdf-0cdc74747cd941b5879a4d2de6c7a71a9b99a23b.tar.xz |
Support empty and little-endian UTF-16 strings.
Also don't read out of bounds if the string is cut short in the
middle of the last two-byte character.
Diffstat (limited to 'pdf/pdf_parse.c')
-rw-r--r-- | pdf/pdf_parse.c | 34 |
1 files changed, 27 insertions, 7 deletions
diff --git a/pdf/pdf_parse.c b/pdf/pdf_parse.c index d6497bc4..54ed97c1 100644 --- a/pdf/pdf_parse.c +++ b/pdf/pdf_parse.c @@ -40,11 +40,11 @@ pdf_to_utf8(fz_obj *src) int ucs; int i; - if (srclen > 2 && srcptr[0] == 254 && srcptr[1] == 255) + if (srclen >= 2 && srcptr[0] == 254 && srcptr[1] == 255) { for (i = 2; i < srclen; i += 2) { - ucs = (srcptr[i] << 8) | srcptr[i+1]; + ucs = srcptr[i] << 8 | srcptr[i+1]; dstlen += runelen(ucs); } @@ -52,11 +52,26 @@ pdf_to_utf8(fz_obj *src) for (i = 2; i < srclen; i += 2) { - ucs = (srcptr[i] << 8) | srcptr[i+1]; + ucs = srcptr[i] << 8 | srcptr[i+1]; dstptr += runetochar(dstptr, &ucs); } } + else if (srclen >= 2 && srcptr[0] == 255 && srcptr[1] == 254) + { + for (i = 2; i + 1 < srclen; i += 2) + { + ucs = srcptr[i] | srcptr[i+1] << 8; + dstlen += runelen(ucs); + } + dstptr = dst = fz_malloc(dstlen + 1); + + for (i = 2; i + 1 < srclen; i += 2) + { + ucs = srcptr[i] | srcptr[i+1] << 8; + dstptr += runetochar(dstptr, &ucs); + } + } else { for (i = 0; i < srclen; i++) @@ -84,13 +99,18 @@ pdf_to_ucs2(fz_obj *src) int srclen = fz_to_str_len(src); int i; - if (srclen > 2 && srcptr[0] == 254 && srcptr[1] == 255) + if (srclen >= 2 && srcptr[0] == 254 && srcptr[1] == 255) { dstptr = dst = fz_calloc((srclen - 2) / 2 + 1, sizeof(short)); - for (i = 2; i < srclen; i += 2) - *dstptr++ = (srcptr[i] << 8) | srcptr[i+1]; + for (i = 2; i + 1 < srclen; i += 2) + *dstptr++ = srcptr[i] << 8 | srcptr[i+1]; + } + else if (srclen >= 2 && srcptr[0] == 255 && srcptr[1] == 254) + { + dstptr = dst = fz_calloc((srclen - 2) / 2 + 1, sizeof(short)); + for (i = 2; i + 1 < srclen; i += 2) + *dstptr++ = srcptr[i] | srcptr[i+1] << 8; } - else { dstptr = dst = fz_calloc(srclen + 1, sizeof(short)); |