diff options
Diffstat (limited to 'source/pdf/pdf-xref.c')
| -rw-r--r-- | source/pdf/pdf-xref.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 9a3cfd37..1cf89de9 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -382,6 +382,8 @@ pdf_xref_size_from_old_trailer(pdf_document *doc, pdf_lexbuf *buf) t = fz_tell(doc->file); if (t < 0) fz_throw(doc->ctx, FZ_ERROR_GENERIC, "cannot tell in file"); + if (len > (INT_MAX - t) / 20) + fz_throw(doc->ctx, FZ_ERROR_GENERIC, "xref has too many entries"); fz_seek(doc->file, t + 20 * len, SEEK_SET); } |