diff options
| author | Simon Bünzli <zeniko@gmail.com> | 2015-01-08 21:39:24 +0100 |
|---|---|---|
| committer | Simon Bünzli <zeniko@gmail.com> | 2015-01-20 20:55:58 +0100 |
| commit | 3f7e3314739c91a170677954f160ee978eed76c7 (patch) | |
| tree | a6e4330881f6ab60b7bc2a8ccb7f96ace5c835e0 /source/pdf/pdf-lex.c | |
| parent | 8fd4ad0a0ba69e5ab7d52b486073d050e3d8c29c (diff) | |
| download | mupdf-3f7e3314739c91a170677954f160ee978eed76c7.tar.xz | |
don't decode '8' and '9' as octal digits
At https://github.com/sumatrapdfreader/sumatrapdf/issues/66 there's a
document which contains a string (\358) which is parsed as (\360) with
the 8 overflowing instead of as (\0358) with the 8 being the first
character after the octal escape. This patch restricts octal digits to
'0' to '7' to fix that issue.
Diffstat (limited to 'source/pdf/pdf-lex.c')
| -rw-r--r-- | source/pdf/pdf-lex.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/source/pdf/pdf-lex.c b/source/pdf/pdf-lex.c index 6a4033f9..096cb540 100644 --- a/source/pdf/pdf-lex.c +++ b/source/pdf/pdf-lex.c @@ -21,6 +21,8 @@ 'a':case'b':case'c':case'd':case'e':case'f' #define RANGE_A_F \ 'A':case'B':case'C':case'D':case'E':case'F' +#define RANGE_0_7 \ + '0':case'1':case'2':case'3':case'4':case'5':case'6':case'7' static inline int iswhite(int ch) { @@ -290,14 +292,14 @@ lex_string(fz_stream *f, pdf_lexbuf *lb) case '\\': *s++ = '\\'; break; - case RANGE_0_9: + case RANGE_0_7: oct = c - '0'; c = fz_read_byte(f); - if (c >= '0' && c <= '9') + if (c >= '0' && c <= '7') { oct = oct * 8 + (c - '0'); c = fz_read_byte(f); - if (c >= '0' && c <= '9') + if (c >= '0' && c <= '7') oct = oct * 8 + (c - '0'); else if (c != EOF) fz_unread_byte(f); |