diff options
| author | Tor Andersson <tor.andersson@artifex.com> | 2017-10-16 13:14:25 +0200 |
|---|---|---|
| committer | Tor Andersson <tor.andersson@artifex.com> | 2017-10-16 14:36:28 +0200 |
| commit | 82df2631d7d0446b206ea6b434ea609b6c28b0e8 (patch) | |
| tree | 731aa78c58ff7101769cf2d55f23419dfef67048 /source | |
| parent | 3d07ca6504717c58547921998622e0a929aba882 (diff) | |
| download | mupdf-82df2631d7d0446b206ea6b434ea609b6c28b0e8.tar.xz | |
Check for integer overflow when validating new style xref Index.
Diffstat (limited to 'source')
| -rw-r--r-- | source/pdf/pdf-xref.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 66bd0ed8..62927936 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -924,7 +924,7 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, fz pdf_xref_entry *table; int i, n; - if (i0 < 0 || i1 < 0) + if (i0 < 0 || i1 < 0 || (i0+i1) < 0) fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index"); //if (i0 + i1 > pdf_xref_len(ctx, doc)) // fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries"); |