diff options
| author | Robin Watts <robin.watts@artifex.com> | 2016-11-25 14:23:32 +0000 |
|---|---|---|
| committer | Robin Watts <Robin.Watts@artifex.com> | 2016-12-08 11:57:17 +0000 |
| commit | 4916a2fa24e65fab1e961a5a6702c929287ed39c (patch) | |
| tree | 0316a3ca24fe9db3a35bf430869e8aecc9851059 /source/pdf | |
| parent | ffbe41a191dd6355a0bab327b539f9497ad5a7a9 (diff) | |
| download | mupdf-4916a2fa24e65fab1e961a5a6702c929287ed39c.tar.xz | |
Fix incorrect recursive object marking.
We use pdf_mark_obj/pdf_unmark_obj to catch cycles when
traversing PDF structures. In some cases we were failing
to actually test the return code, making it pointless.
Diffstat (limited to 'source/pdf')
| -rw-r--r-- | source/pdf/pdf-cmap-load.c | 3 | ||||
| -rw-r--r-- | source/pdf/pdf-colorspace.c | 3 | ||||
| -rw-r--r-- | source/pdf/pdf-function.c | 3 |
3 files changed, 6 insertions, 3 deletions
diff --git a/source/pdf/pdf-cmap-load.c b/source/pdf/pdf-cmap-load.c index 1cfe9dec..87b1c282 100644 --- a/source/pdf/pdf-cmap-load.c +++ b/source/pdf/pdf-cmap-load.c @@ -52,7 +52,8 @@ pdf_load_embedded_cmap(fz_context *ctx, pdf_document *doc, pdf_obj *stmobj) } else if (pdf_is_indirect(ctx, obj)) { - pdf_mark_obj(ctx, obj); + if (pdf_mark_obj(ctx, obj)) + fz_throw(ctx, FZ_ERROR_GENERIC, "recursive CMap"); fz_try(ctx) usecmap = pdf_load_embedded_cmap(ctx, doc, obj); fz_always(ctx) diff --git a/source/pdf/pdf-colorspace.c b/source/pdf/pdf-colorspace.c index a1fd8140..f9a95335 100644 --- a/source/pdf/pdf-colorspace.c +++ b/source/pdf/pdf-colorspace.c @@ -259,7 +259,8 @@ pdf_load_colorspace_imp(fz_context *ctx, pdf_document *doc, pdf_obj *obj) fz_colorspace *cs; fz_try(ctx) { - pdf_mark_obj(ctx, obj); + if (pdf_mark_obj(ctx, obj)) + fz_throw(ctx, FZ_ERROR_GENERIC, "recursive colorspace"); if (pdf_name_eq(ctx, name, PDF_NAME_ICCBased)) cs = load_icc_based(ctx, doc, pdf_array_get(ctx, obj, 1)); diff --git a/source/pdf/pdf-function.c b/source/pdf/pdf-function.c index 1207b191..b319dd97 100644 --- a/source/pdf/pdf-function.c +++ b/source/pdf/pdf-function.c @@ -1220,7 +1220,8 @@ load_stitching_func(fz_context *ctx, pdf_document *doc, pdf_function *func, pdf_ fz_try(ctx) { - pdf_mark_obj(ctx, obj); + if (pdf_mark_obj(ctx, obj)) + fz_throw(ctx, FZ_ERROR_GENERIC, "recursive function"); k = pdf_array_len(ctx, obj); func->u.st.funcs = fz_malloc_array(ctx, k, sizeof(fz_function*)); |