diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2017-12-13 21:14:19 +0100 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2017-12-13 21:38:26 +0100 |
| commit | 2a1611030030e18010a0ab1d69eda0359eb5f585 (patch) | |
| tree | 7105fdb1a9be387634fe90f1111589a2eb473a2f /source | |
| parent | b1ee9743699d8289864c2080c0a5daf74c5c81cc (diff) | |
| download | mupdf-2a1611030030e18010a0ab1d69eda0359eb5f585.tar.xz | |
Validate that /Size in trailer is in range.
Diffstat (limited to 'source')
| -rw-r--r-- | source/pdf/pdf-xref.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index f2ba5a5d..392adf33 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -748,8 +748,8 @@ pdf_xref_size_from_old_trailer(fz_context *ctx, pdf_document *doc, pdf_lexbuf *b trailer = pdf_parse_dict(ctx, doc, doc->file, buf); size = pdf_to_int(ctx, pdf_dict_get(ctx, trailer, PDF_NAME_Size)); - if (!size) - fz_throw(ctx, FZ_ERROR_GENERIC, "trailer missing Size entry"); + if (size < 0 || size > PDF_MAX_OBJECT_NUMBER + 1) + fz_throw(ctx, FZ_ERROR_GENERIC, "trailer Size entry out of range"); } fz_always(ctx) { |