summaryrefslogtreecommitdiff
path: root/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc')
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc21
1 files changed, 17 insertions, 4 deletions
diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
index 6fbf8b5d032..4c78a9dc165 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc
@@ -59,6 +59,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
objs = NULL;
objNums = NULL;
offsets = NULL;
+ ok = gFalse;
if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) {
goto err1;
@@ -85,6 +86,13 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
goto err1;
}
+ // this is an arbitrary limit to avoid integer overflow problems
+ // in the 'new Object[nObjects]' call (Acrobat apparently limits
+ // object streams to 100-200 objects)
+ if (nObjects > 1000000) {
+ error(-1, "Too many objects in an object stream");
+ goto err1;
+ }
objs = new Object[nObjects];
objNums = (int *)gmallocn(nObjects, sizeof(int));
offsets = (int *)gmallocn(nObjects, sizeof(int));
@@ -101,7 +109,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
obj1.free();
obj2.free();
delete parser;
-// gfree(offsets);
+// gfree(offsets);
goto err1;
}
objNums[i] = obj1.getInt();
@@ -111,7 +119,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
if (objNums[i] < 0 || offsets[i] < 0 ||
(i > 0 && offsets[i] < offsets[i-1])) {
delete parser;
-// gfree(offsets);
+// gfree(offsets);
goto err1;
}
}
@@ -140,11 +148,11 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) {
delete parser;
}
-// gfree(offsets);
+//gfree(offsets);
+ ok = gTrue;
err1:
objStr.free();
- return;
}
ObjectStream::~ObjectStream() {
@@ -818,6 +826,11 @@ Object *XRef::fetch(int num, int gen, Object *obj) {
delete objStr;
}
objStr = new ObjectStream(this, e->offset);
+ if (!objStr->isOk()) {
+ delete objStr;
+ objStr = NULL;
+ goto err;
+ }
}
objStr->getObject(e->gen, num, obj);
break;