diff options
| -rw-r--r-- | mupdf/pdf_pagetree.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/mupdf/pdf_pagetree.c b/mupdf/pdf_pagetree.c index 2501c80a..c1625275 100644 --- a/mupdf/pdf_pagetree.c +++ b/mupdf/pdf_pagetree.c @@ -89,6 +89,13 @@ loadpagetree(pdf_xref *xref, pdf_pagetree *pages, error = pdf_loadindirect(&kobj, xref, kref); if (error) { fz_dropobj(kids); return fz_rethrow(error, "cannot load kid"); } + if (kobj == obj) + { + /* prevent infinite recursion possible in maliciously crafted PDFs */ + fz_dropobj(kids); + return fz_throw("corrupted pdf file"); + } + error = loadpagetree(xref, pages, inherit, kobj, kref, pagenum); fz_dropobj(kobj); if (error) { fz_dropobj(kids); return fz_rethrow(error, "cannot load subtree"); } |