diff options
| author | Robin Watts <robin.watts@artifex.com> | 2014-01-21 18:28:21 +0000 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2014-01-21 18:34:53 +0000 |
| commit | d695605c5d91b951a9c37f64a843e92caaa178e9 (patch) | |
| tree | 3aff3bb5d759f8cebfb6649628dc019da93c013c /source/pdf/pdf-object.c | |
| parent | 3f766db16a6fea2a0b8c568ba9475a54a8a1a023 (diff) | |
| download | mupdf-d695605c5d91b951a9c37f64a843e92caaa178e9.tar.xz | |
Bug 694900: Avoid valgrind problems when cmap tables fill up.
The test file on this bug:
de53b4bd41191f02d01a3c39b4880fa8_asan_heap-oob_caba3c_9561_7427.pdf
includes a corrupt CMAP. When this is read into memory it produces
a CMAP where the table gets too large. This produces lots of warnings
from 'add_table', but the calls to add_table all assume that the
process completed fine, resulting in range entries being added
that point to nonexistent values.
The fix is to make add_table return a bool to indicate success or
failure, and to only add range entries if the add_table succeeds.
Thanks to Mateusz Jurczyk and Gynvael Coldwind of the Google Security
Team for providing the example files.
Diffstat (limited to 'source/pdf/pdf-object.c')
0 files changed, 0 insertions, 0 deletions