diff options
| author | JUN FANG <jun_fang@foxitsoftware.com> | 2014-12-17 13:58:56 -0800 |
|---|---|---|
| committer | JUN FANG <jun_fang@foxitsoftware.com> | 2014-12-17 13:58:56 -0800 |
| commit | dba5bfd174589ad08c4231b039297b59fa2ccc3b (patch) | |
| tree | 89bfb44bb54574587e95ecc5c67ddda3207f276c /core | |
| parent | 7be67b2e4f496cb638b365264ce835e3b23a555e (diff) | |
| download | pdfium-dba5bfd174589ad08c4231b039297b59fa2ccc3b.tar.xz | |
Fix a bug that occurs when an object has the same object number with the root object
Before this fix, the root will be released when an indirect object has the
same object number with the root. However, the root object is loaded when
the trailer is parsed. It shall not be updated or replaced anymore.
BUG=425040
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/803103002
Diffstat (limited to 'core')
| -rw-r--r-- | core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp index 2f834ea400..9fa26d87ae 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp @@ -1003,7 +1003,15 @@ FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL return FALSE; } if (m_pDocument) { - m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream); + CPDF_Dictionary * pDict = m_pDocument->GetRoot(); + if (!pDict || pDict->GetObjNum() != pStream->m_ObjNum) { + m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream); + } else { + if (pStream->GetType() == PDFOBJ_STREAM) { + pStream->Release(); + } + return FALSE; + } } if (pStream->GetType() != PDFOBJ_STREAM) { return FALSE; |