summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorJUN FANG <jun_fang@foxitsoftware.com>2014-12-17 13:58:56 -0800
committerJUN FANG <jun_fang@foxitsoftware.com>2014-12-17 13:58:56 -0800
commitdba5bfd174589ad08c4231b039297b59fa2ccc3b (patch)
tree89bfb44bb54574587e95ecc5c67ddda3207f276c /core
parent7be67b2e4f496cb638b365264ce835e3b23a555e (diff)
downloadpdfium-dba5bfd174589ad08c4231b039297b59fa2ccc3b.tar.xz
Fix a bug that occurs when an object has the same object number with the root object
Before this fix, the root will be released when an indirect object has the same object number with the root. However, the root object is loaded when the trailer is parsed. It shall not be updated or replaced anymore. BUG=425040 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/803103002
Diffstat (limited to 'core')
-rw-r--r--core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp10
1 files changed, 9 insertions, 1 deletions
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 2f834ea400..9fa26d87ae 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1003,7 +1003,15 @@ FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL
return FALSE;
}
if (m_pDocument) {
- m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream);
+ CPDF_Dictionary * pDict = m_pDocument->GetRoot();
+ if (!pDict || pDict->GetObjNum() != pStream->m_ObjNum) {
+ m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream);
+ } else {
+ if (pStream->GetType() == PDFOBJ_STREAM) {
+ pStream->Release();
+ }
+ return FALSE;
+ }
}
if (pStream->GetType() != PDFOBJ_STREAM) {
return FALSE;