diff options
| -rw-r--r-- | pdf/pdf_xref.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/pdf/pdf_xref.c b/pdf/pdf_xref.c index 350249a3..23e4b79a 100644 --- a/pdf/pdf_xref.c +++ b/pdf/pdf_xref.c @@ -900,6 +900,11 @@ pdf_load_obj_stm(pdf_document *xref, int num, int gen, pdf_lexbuf *buf) count = pdf_to_int(pdf_dict_gets(objstm, "N")); first = pdf_to_int(pdf_dict_gets(objstm, "First")); + if (count < 0) + fz_throw(ctx, "negative number of objects in object stream"); + if (first < 0) + fz_throw(ctx, "first object in object stream resides outside stream"); + numbuf = fz_calloc(ctx, count, sizeof(int)); ofsbuf = fz_calloc(ctx, count, sizeof(int)); |