diff options
| author | thestig <thestig@chromium.org> | 2016-08-12 20:00:32 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-08-12 20:00:32 -0700 |
| commit | 9fe6f3ad47ca099efe5ae18aabfae6594a1e0329 (patch) | |
| tree | ef27988e1e75a43a78006813b90ec99a359c65aa | |
| parent | 8374fe4a11a513b23297e29d38c376d8cf36e8bf (diff) | |
| download | pdfium-9fe6f3ad47ca099efe5ae18aabfae6594a1e0329.tar.xz | |
Avoid an undefined shift in ReadPageHintTable().
Even 39 bits is very generous for the number of bits needed to represent
the greatest number of shared object references.
BUG=637119
Review-Url: https://codereview.chromium.org/2242723002
| -rw-r--r-- | core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp index 63a64a3026..7a3fbacfb3 100644 --- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp +++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp @@ -109,6 +109,12 @@ FX_BOOL CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) { // Item 13: Skip Item 13 which has 16 bits. hStream->SkipBits(16); + // The maximum number of bits allowed to represent the greatest number of + // shared object references. 2^39 should be more than enough. + constexpr uint32_t kMaxSharedObjBits = 39; + if (dwSharedObjBits > kMaxSharedObjBits) + return FALSE; + CPDF_Object* pPageNum = m_pLinearizedDict->GetDirectObjectBy("N"); int nPages = pPageNum ? pPageNum->GetInteger() : 0; if (nPages < 1) |