summaryrefslogtreecommitdiff
path: root/core/src/fpdfapi
diff options
context:
space:
mode:
authorJUN FANG <jun_fang@foxitsoftware.com>2015-04-10 13:45:43 -0700
committerJUN FANG <jun_fang@foxitsoftware.com>2015-04-10 13:45:43 -0700
commit1569728e9f5a60b033e530ee1d4cd99e467649da (patch)
tree516d4e5625d98ddd6493fe416810dae54cf1cc1a /core/src/fpdfapi
parente45a2e4ff91a672d555951963e329cf224d486d6 (diff)
downloadpdfium-1569728e9f5a60b033e530ee1d4cd99e467649da.tar.xz
Fix a stack overflow in CPDF_Parser::LoadCrossRefV5
A stack overflow was triggered by checked_cast due to invalid index in pdf files like 'Index[45 -1661]'. BUG=473400 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1054303005
Diffstat (limited to 'core/src/fpdfapi')
-rw-r--r--core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp6
1 files changed, 5 insertions, 1 deletions
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 592f24f40b..4be403bba6 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1039,7 +1039,11 @@ FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL
CPDF_Object* pCountObj = pArray->GetElement(i * 2 + 1);
if (pStartNumObj && pStartNumObj->GetType() == PDFOBJ_NUMBER
&& pCountObj && pCountObj->GetType() == PDFOBJ_NUMBER) {
- arrIndex.push_back(std::make_pair(pStartNumObj->GetInteger(), pCountObj->GetInteger()));
+ int nStartNum = pStartNumObj->GetInteger();
+ int nCount = pCountObj->GetInteger();
+ if (nStartNum >= 0 && nCount > 0) {
+ arrIndex.push_back(std::make_pair(nStartNum, nCount));
+ }
}
}
}