diff options
| author | Robin Watts <robin.watts@artifex.com> | 2013-09-23 17:30:50 +0100 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2013-09-23 17:30:50 +0100 |
| commit | 9f879e14e5645aff6b4be27271f2196c05f5a193 (patch) | |
| tree | 73f755994aae0c3e3feb113513951385e81c9109 /source/pdf/pdf-xref.c | |
| parent | d4a770a4cb0fc25a929ac494ea0d239bda2fa046 (diff) | |
| download | mupdf-9f879e14e5645aff6b4be27271f2196c05f5a193.tar.xz | |
Bug 694565: Cope with negative xref counts when reading old trailers.
This was causing an infinite loop.
Diffstat (limited to 'source/pdf/pdf-xref.c')
| -rw-r--r-- | source/pdf/pdf-xref.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 01a584e3..6d440418 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -363,6 +363,8 @@ pdf_xref_size_from_old_trailer(pdf_document *doc, pdf_lexbuf *buf) if (!s) fz_throw(doc->ctx, FZ_ERROR_GENERIC, "invalid range marker in xref"); len = fz_atoi(fz_strsep(&s, " ")); + if (len <= 0) + fz_throw(doc->ctx, FZ_ERROR_GENERIC, "xref range marker must be positive"); /* broken pdfs where the section is not on a separate line */ if (s && *s != '\0') |