diff options
| author | Simon Bünzli <zeniko@gmail.com> | 2014-01-08 18:59:41 +0100 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2014-01-08 18:10:06 +0000 |
| commit | 98a111c8e49916f8f5ac21d11f4627540f9ddd49 (patch) | |
| tree | afd7545fbecf226252e31e45e8c30b6717cc07e6 /source/tools | |
| parent | bdb5cdee34edc38e47bf9b3a9830830d072f0c91 (diff) | |
| download | mupdf-98a111c8e49916f8f5ac21d11f4627540f9ddd49.tar.xz | |
prevent heap access violation in pdf_cache_object
pdf_load_obj_stm may resize the xref if it finds further objects in the
stream, that might however invalidate any pdf_xref_entry hold such as
the one in pdf_cache_object. This can be seen e.g. with
7ac3ad9ddad98d10b947a43cf640062f_asan_heap-uaf_930b78_1007_1675.pdf
Thanks to Mateusz Jurczyk and Gynvael Coldwind of the Google Security
Team for providing the example files.
Diffstat (limited to 'source/tools')
0 files changed, 0 insertions, 0 deletions