From 10f9fb3f10bc47b3317fe1c8b55711015fb7de87 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Thu, 5 Apr 2018 17:54:26 +0000 Subject: Ignore bad data in the shared object hint table. Currently this is being treated as a case of "data not available" which leads to an infinite loop. BUG=pdfium:1055 Change-Id: I2722a5b364d56a4ad5b7cca2a4b42e6b13a933f4 Reviewed-on: https://pdfium-review.googlesource.com/29831 Commit-Queue: Lei Zhang Reviewed-by: dsinclair --- core/fpdfapi/parser/cpdf_hint_tables.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'core') diff --git a/core/fpdfapi/parser/cpdf_hint_tables.cpp b/core/fpdfapi/parser/cpdf_hint_tables.cpp index c9123d4b97..381b160233 100644 --- a/core/fpdfapi/parser/cpdf_hint_tables.cpp +++ b/core/fpdfapi/parser/cpdf_hint_tables.cpp @@ -418,8 +418,9 @@ CPDF_DataAvail::DocAvailStatus CPDF_HintTables::CheckPage(uint32_t index) { return CPDF_DataAvail::DataError; if (!m_pValidator->CheckDataRangeAndRequestIfUnavailable( - m_szPageOffsetArray[index], dwLength)) + m_szPageOffsetArray[index], dwLength)) { return CPDF_DataAvail::DataNotAvailable; + } // Download data of shared objects in the page. uint32_t offset = 0; @@ -435,7 +436,7 @@ CPDF_DataAvail::DocAvailStatus CPDF_HintTables::CheckPage(uint32_t index) { for (uint32_t j = 0; j < m_dwNSharedObjsArray[index]; ++j) { dwIndex = m_dwIdentifierArray[offset + j]; if (dwIndex >= m_dwSharedObjNumArray.size()) - return CPDF_DataAvail::DataNotAvailable; + continue; dwObjNum = m_dwSharedObjNumArray[dwIndex]; if (dwObjNum >= static_cast(nFirstPageObjNum) && -- cgit v1.2.3