Fix bug 692248. Ensure objstm references are valid.

1 files changed, 5 insertions, 0 deletions

diff --git a/pdf/pdf_xref.c b/pdf/pdf_xref.c
index 6f85671a..844141ad 100644
--- a/pdf/pdf_xref.c
+++ b/pdf/pdf_xref.c
@@ -496,9 +496,14 @@ pdf_load_xref(pdf_xref *xref, char *buf, int bufsize)
 
 	/* broken pdfs where object offsets are out of range */
 	for (i = 0; i < xref->len; i++)
+	{
 		if (xref->table[i].type == 'n')
 			if (xref->table[i].ofs <= 0 || xref->table[i].ofs >= xref->file_size)
 				return fz_throw("object offset out of range: %d (%d 0 R)", xref->table[i].ofs, i);
+		if (xref->table[i].type == 'o')
+			if (xref->table[i].ofs <= 0 || xref->table[i].ofs >= xref->len || xref->table[xref->table[i].ofs].type != 'n')
+				return fz_throw("invalid reference to an objstm that does not exist: %d (%d 0 R)", xref->table[i].ofs, i);
+	}
 
 	return fz_okay;
 }