diff options
| author | zeniko <zeniko@gmail.com> | 2013-06-13 20:16:47 +0200 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2013-06-24 11:45:21 +0100 |
| commit | 0516026e17ece7d0d08531ee0c5d272de4802fc7 (patch) | |
| tree | c0d2853144b5a466b9cbd6908d902b32809cae56 /source/pdf/pdf-xref.c | |
| parent | f2398d9481de6e3685685d755c289681c7539a7f (diff) | |
| download | mupdf-0516026e17ece7d0d08531ee0c5d272de4802fc7.tar.xz | |
fix recent regressions
* at one place, code returns from inside an fz_try which borks up the
error stack
* pdf_load_xref wrongly assumes that at least one non-empty xref has
been read if there were no errors thrown during parsing
* pdf_repair_xref skips integers when object numbers are out of range
Diffstat (limited to 'source/pdf/pdf-xref.c')
| -rw-r--r-- | source/pdf/pdf-xref.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index d4b94e3f..ad771df3 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -613,7 +613,7 @@ read_xref_section(pdf_document *xref, int ofs, pdf_lexbuf *buf, ofs_list *offset if (i < offsets->len) { fz_warn(ctx, "ignoring xref recursion with offset %d", ofs); - return 0; + break; } if (offsets->len == offsets->max) { @@ -704,6 +704,9 @@ pdf_load_xref(pdf_document *xref, pdf_lexbuf *buf) pdf_read_xref_sections(xref, xref->startxref, buf); + if (pdf_xref_len(xref) == 0) + fz_throw(ctx, FZ_ERROR_GENERIC, "found xref was empty"); + /* broken pdfs where first object is not free */ if (pdf_get_xref_entry(xref, 0)->type != 'f') fz_throw(ctx, FZ_ERROR_GENERIC, "first object in xref is not free"); |