diff options
| author | Robin Watts <robin@peeves.(none)> | 2013-05-24 07:28:50 -0700 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2013-05-27 19:24:06 +0100 |
| commit | 95cf5b2cb3aa20b3203286e14b67064774270a4b (patch) | |
| tree | 0407bdcc19d6038575a5ca152f3350db61a038ed /pdf | |
| parent | f59fce4e8effe57adb3a4ba4f615f5028dd4f213 (diff) | |
| download | mupdf-95cf5b2cb3aa20b3203286e14b67064774270a4b.tar.xz | |
Solve fuzzing SEGV due to negative object number in xref.
Diffstat (limited to 'pdf')
| -rw-r--r-- | pdf/pdf_xref.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/pdf/pdf_xref.c b/pdf/pdf_xref.c index 0be3740f..b3455773 100644 --- a/pdf/pdf_xref.c +++ b/pdf/pdf_xref.c @@ -230,6 +230,9 @@ pdf_read_old_xref(pdf_document *xref, pdf_lexbuf *buf) fz_seek(xref->file, -(2 + (int)strlen(s)), 1); } + if (ofs < 0) + fz_throw(xref->ctx, "out of range object num in xref: %d", ofs); + /* broken pdfs where size in trailer undershoots entries in xref sections */ if (ofs + len > xref->len) { |