diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2012-07-26 01:18:04 +0200 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2012-07-26 01:18:04 +0200 |
| commit | 63b4289d48c3872e71588476cafcabbd7f3ae565 (patch) | |
| tree | 8af400a0ebac9f38437553226bef65ea0fb21570 /pdf | |
| parent | 72b3934e17440e1b9faa885d63153e0fe17e2401 (diff) | |
| download | mupdf-63b4289d48c3872e71588476cafcabbd7f3ae565.tar.xz | |
Gracefully handle negative xref stream object range boundaries
An xref stream describes objects within a range of object numbers.
Fail if either of these are negative.
Diffstat (limited to 'pdf')
| -rw-r--r-- | pdf/pdf_xref.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/pdf/pdf_xref.c b/pdf/pdf_xref.c index a6c0e0cf..52db0644 100644 --- a/pdf/pdf_xref.c +++ b/pdf/pdf_xref.c @@ -273,7 +273,9 @@ pdf_read_new_xref_section(pdf_document *xref, fz_stream *stm, int i0, int i1, in { int i, n; - if (i0 < 0 || i0 + i1 > xref->len) + if (i0 < 0 || i1 < 0) + fz_throw(xref->ctx, "negative xref stream entry index"); + if (i0 + i1 > xref->len) fz_throw(xref->ctx, "xref stream has too many entries"); for (i = i0; i < i0 + i1; i++) |