diff options
| author | Robin Watts <robin.watts@artifex.com> | 2014-01-03 18:17:11 +0000 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2014-01-06 13:13:42 +0000 |
| commit | 016adfa063293281a0896c62bf22e406b09ddf21 (patch) | |
| tree | e123429880bc07006a853e23783deec080cc2840 /source/xps | |
| parent | 0bfa2ce884eed8bef83fb23cf2e25dae81a2207e (diff) | |
| download | mupdf-016adfa063293281a0896c62bf22e406b09ddf21.tar.xz | |
Bug 694869: Fix indetermisms with broken PNG files.
This bug shows 2 problems with our data handling.
Firstly, if a zip file entry has less data in the stream than it
is declared to have, we would leave the end of the data uninitialised.
We now put out a warning, and blank it with zeros.
Secondly, if the PNG decompression fails to decode enough data, we
don't notice. Now we give a warning and blank the remaining pixels.
Diffstat (limited to 'source/xps')
| -rw-r--r-- | source/xps/xps-zip.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/source/xps/xps-zip.c b/source/xps/xps-zip.c index f70a28bf..da1450e3 100644 --- a/source/xps/xps-zip.c +++ b/source/xps/xps-zip.c @@ -169,6 +169,12 @@ xps_read_zip_entry(xps_document *doc, xps_entry *ent, unsigned char *outbuf) } fz_free(ctx, inbuf); + + if (stream.avail_out > 0) + { + fz_warn(ctx, "Truncated zipfile entry found, possibly corrupt data"); + memset(stream.next_out, 0, stream.avail_out); + } } else { |