summaryrefslogtreecommitdiff
path: root/core/fpdfapi
diff options
context:
space:
mode:
authorthestig <thestig@chromium.org>2016-08-12 20:00:32 -0700
committerCommit bot <commit-bot@chromium.org>2016-08-12 20:00:32 -0700
commit9fe6f3ad47ca099efe5ae18aabfae6594a1e0329 (patch)
treeef27988e1e75a43a78006813b90ec99a359c65aa /core/fpdfapi
parent8374fe4a11a513b23297e29d38c376d8cf36e8bf (diff)
downloadpdfium-9fe6f3ad47ca099efe5ae18aabfae6594a1e0329.tar.xz
Avoid an undefined shift in ReadPageHintTable().
Even 39 bits is very generous for the number of bits needed to represent the greatest number of shared object references. BUG=637119 Review-Url: https://codereview.chromium.org/2242723002
Diffstat (limited to 'core/fpdfapi')
-rw-r--r--core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp6
1 files changed, 6 insertions, 0 deletions
diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
index 63a64a3026..7a3fbacfb3 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
@@ -109,6 +109,12 @@ FX_BOOL CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
// Item 13: Skip Item 13 which has 16 bits.
hStream->SkipBits(16);
+ // The maximum number of bits allowed to represent the greatest number of
+ // shared object references. 2^39 should be more than enough.
+ constexpr uint32_t kMaxSharedObjBits = 39;
+ if (dwSharedObjBits > kMaxSharedObjBits)
+ return FALSE;
+
CPDF_Object* pPageNum = m_pLinearizedDict->GetDirectObjectBy("N");
int nPages = pPageNum ? pPageNum->GetInteger() : 0;
if (nPages < 1)