26 lines
702 B
Diff
26 lines
702 B
Diff
|
From 004e3c10df0abda214f0c293f9e269fdd979c5ee Mon Sep 17 00:00:00 2001
|
||
|
|
From: Albert Astals Cid <aacid@kde.org>
|
||
|
|
Date: Wed, 18 Jul 2018 20:31:27 +0200
|
||
|
|
Subject: Fix crash when Object has negative number
|
||
|
|
|
||
|
|
Spec says object number has to be > 0 and gen has to be >= 0
|
||
|
|
|
||
|
|
Reported by email
|
||
|
|
|
||
|
|
diff --git a/poppler/Parser.cc b/poppler/Parser.cc
|
||
|
|
index 39c9a967..8b0093e3 100644
|
||
|
|
--- a/poppler/Parser.cc
|
||
|
|
+++ b/poppler/Parser.cc
|
||
|
|
@@ -154,6 +154,11 @@ Object Parser::getObj(GBool simpleOnly,
|
||
|
|
const int gen = buf1.getInt();
|
||
|
|
shift();
|
||
|
|
shift();
|
||
|
|
+
|
||
|
|
+ if (unlikely(num <= 0 || gen < 0)) {
|
||
|
|
+ return Object();
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
return Object(num, gen);
|
||
|
|
} else {
|
||
|
|
return Object(num);
|