diff options
| author | Nicolas Pena <npm@chromium.org> | 2017-05-03 12:35:59 -0400 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-05-03 16:49:52 +0000 |
| commit | 746babded81e9de3fc132fd670386382c031fa74 (patch) | |
| tree | a1a7b6d68fc7aa8ff11c145955371371000b4fda /core/fpdfapi/parser/cpdf_syntax_parser.h | |
| parent | 1e5a98afd195930de69f7b468a852717722377b6 (diff) | |
| download | pdfium-746babded81e9de3fc132fd670386382c031fa74.tar.xz | |
SetPos to at most the file length to avoid overflows
This CL prevents arbitrary position setting which may cause integer overflows.
In the bug in question, the PDF says the xrefs are located in a huge position.
This then causes problems when calling CPDF_SyntaxParser methods.
Bug: chromium:603545
Change-Id: I5f94c38f46a0217e9f12f1bf8b2f3bee3b03cb35
Reviewed-on: https://pdfium-review.googlesource.com/4813
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Diffstat (limited to 'core/fpdfapi/parser/cpdf_syntax_parser.h')
| -rw-r--r-- | core/fpdfapi/parser/cpdf_syntax_parser.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/core/fpdfapi/parser/cpdf_syntax_parser.h b/core/fpdfapi/parser/cpdf_syntax_parser.h index 9c2d84070d..f9a9bd9a8a 100644 --- a/core/fpdfapi/parser/cpdf_syntax_parser.h +++ b/core/fpdfapi/parser/cpdf_syntax_parser.h @@ -7,6 +7,7 @@ #ifndef CORE_FPDFAPI_PARSER_CPDF_SYNTAX_PARSER_H_ #define CORE_FPDFAPI_PARSER_CPDF_SYNTAX_PARSER_H_ +#include <algorithm> #include <memory> #include "core/fxcrt/cfx_string_pool_template.h" @@ -29,8 +30,8 @@ class CPDF_SyntaxParser { void InitParser(const CFX_RetainPtr<IFX_SeekableReadStream>& pFileAccess, uint32_t HeaderOffset); - FX_FILESIZE SavePos() const { return m_Pos; } - void RestorePos(FX_FILESIZE pos) { m_Pos = pos; } + FX_FILESIZE GetPos() const { return m_Pos; } + void SetPos(FX_FILESIZE pos) { m_Pos = std::min(pos, m_FileLen); } std::unique_ptr<CPDF_Object> GetObject(CPDF_IndirectObjectHolder* pObjList, uint32_t objnum, |