49 lines
1.9 KiB
Diff
49 lines
1.9 KiB
Diff
From efb68686784f0c58668b7ced990fd173e09346db Mon Sep 17 00:00:00 2001
|
|
From: Albert Astals Cid <aacid@kde.org>
|
|
Date: Thu, 18 Aug 2022 23:41:24 +0200
|
|
Subject: pdfunite: Don't crash in broken documents
|
|
|
|
|
|
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
|
|
index 86e75555..a154f40d 100644
|
|
--- a/utils/pdfunite.cc
|
|
+++ b/utils/pdfunite.cc
|
|
@@ -106,16 +106,21 @@ static void doMergeNameDict(PDFDoc *doc, XRef *srcXRef, XRef *countRef, int oldR
|
|
}
|
|
}
|
|
|
|
-static void doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
|
|
+static bool doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
|
|
{
|
|
Object srcFields = srcFormDict->lookup("Fields");
|
|
Object mergeFields = mergeFormDict->lookup("Fields");
|
|
if (srcFields.isArray() && mergeFields.isArray()) {
|
|
for (int i = 0; i < mergeFields.arrayGetLength(); i++) {
|
|
const Object &value = mergeFields.arrayGetNF(i);
|
|
+ if (!value.isRef()) {
|
|
+ error(errSyntaxError, -1, "Fields object is not a Ref.");
|
|
+ return false;
|
|
+ }
|
|
srcFields.arrayAdd(Object({ value.getRef().num + numOffset, value.getRef().gen }));
|
|
}
|
|
}
|
|
+ return true;
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////
|
|
@@ -332,7 +337,13 @@ int main(int argc, char *argv[])
|
|
if (afObj.isNull()) {
|
|
afObj = pageCatDict->lookupNF("AcroForm").copy();
|
|
} else if (afObj.isDict()) {
|
|
- doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset);
|
|
+ if (!doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset)) {
|
|
+ fclose(f);
|
|
+ delete yRef;
|
|
+ delete countRef;
|
|
+ delete outStr;
|
|
+ return -1;
|
|
+ }
|
|
}
|
|
}
|
|
objectsCount += docs[i]->writePageObjects(outStr, yRef, numOffset, true);
|