diff options
| -rw-r--r-- | core/fpdfapi/parser/cpdf_hint_tables.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/core/fpdfapi/parser/cpdf_hint_tables.cpp b/core/fpdfapi/parser/cpdf_hint_tables.cpp index 8d8aa3263a..71fb6e2843 100644 --- a/core/fpdfapi/parser/cpdf_hint_tables.cpp +++ b/core/fpdfapi/parser/cpdf_hint_tables.cpp @@ -252,6 +252,8 @@ bool CPDF_HintTables::ReadSharedObjHintTable(CFX_BitStream* hStream, // Item 5: The number of bits needed to represent the greatest number of // objects in a shared object group. uint32_t dwSharedObjNumBits = hStream->GetBits(16); + if (dwSharedObjNumBits > 32) + return false; // Item 6: The least length of a shared object group in bytes. uint32_t dwGroupLeastLen = hStream->GetBits(32); |