diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2017-08-02 00:01:06 +0800 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2017-08-02 23:03:28 +0800 |
| commit | 482916cd8cfcd467782dcdd130b0a1768f5fce1b (patch) | |
| tree | c90af8b5a6cf7e3f6b62af847665cf7f73ca12d0 /source/pdf | |
| parent | ca810da853dd09fe3b3a2b5bc7c6606dd4ad31f0 (diff) | |
| download | mupdf-482916cd8cfcd467782dcdd130b0a1768f5fce1b.tar.xz | |
Bug 698279: Throw exception if xref object number offset too big.
Diffstat (limited to 'source/pdf')
| -rw-r--r-- | source/pdf/pdf-xref.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 3ce2cb01..14b8b5bd 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -862,6 +862,8 @@ pdf_read_old_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) if (ofs < 0) fz_throw(ctx, FZ_ERROR_GENERIC, "out of range object num in xref: %d", (int)ofs); + if (ofs > FZ_OFF_MAX - len) + fz_throw(ctx, FZ_ERROR_GENERIC, "xref section object numbers too big"); /* broken pdfs where size in trailer undershoots entries in xref sections */ if (ofs + len > xref_len) |