Blame SOURCES/poppler-0.26.2-invalid-matrix.patch
|
 |
75a61b |
From acc33a6950031ac4a5c759d043d24df0cfa7e8b6 Mon Sep 17 00:00:00 2001
|
|
|
75a61b |
From: Jason Crain <jason@aquaticape.us>
|
|
|
75a61b |
Date: Sat, 20 Dec 2014 02:24:49 -0600
|
|
|
75a61b |
Subject: [PATCH] Check for invalid matrix in annotation
|
|
|
75a61b |
|
|
|
75a61b |
Bug #84990
|
|
|
75a61b |
---
|
|
|
75a61b |
poppler/Gfx.cc | 12 ++++++++++--
|
|
|
75a61b |
1 file changed, 10 insertions(+), 2 deletions(-)
|
|
|
75a61b |
|
|
|
75a61b |
diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc
|
|
|
75a61b |
index 64a9d7b..77693f9 100644
|
|
|
75a61b |
--- a/poppler/Gfx.cc
|
|
|
75a61b |
+++ b/poppler/Gfx.cc
|
|
|
75a61b |
@@ -37,6 +37,7 @@
|
|
|
75a61b |
// Copyright (C) 2012 Even Rouault <even.rouault@mines-paris.org>
|
|
|
75a61b |
// Copyright (C) 2012, 2013 Fabio D'Urso <fabiodurso@hotmail.it>
|
|
|
75a61b |
// Copyright (C) 2012 Lu Wang <coolwanglu@gmail.com>
|
|
|
75a61b |
+// Copyright (C) 2014 Jason Crain <jason@aquaticape.us>
|
|
|
75a61b |
//
|
|
|
75a61b |
// To see a description of the changes please see the Changelog file that
|
|
|
75a61b |
// came with your tarball or type make ChangeLog if you are building from git
|
|
|
75a61b |
@@ -5285,8 +5286,15 @@ void Gfx::drawAnnot(Object *str, AnnotBorder *border, AnnotColor *aColor,
|
|
|
75a61b |
if (matrixObj.isArray() && matrixObj.arrayGetLength() >= 6) {
|
|
|
75a61b |
for (i = 0; i < 6; ++i) {
|
|
|
75a61b |
matrixObj.arrayGet(i, &obj1);
|
|
|
75a61b |
- m[i] = obj1.getNum();
|
|
|
75a61b |
- obj1.free();
|
|
|
75a61b |
+ if (likely(obj1.isNum())) {
|
|
|
75a61b |
+ m[i] = obj1.getNum();
|
|
|
75a61b |
+ obj1.free();
|
|
|
75a61b |
+ } else {
|
|
|
75a61b |
+ obj1.free();
|
|
|
75a61b |
+ matrixObj.free();
|
|
|
75a61b |
+ error(errSyntaxError, getPos(), "Bad form matrix");
|
|
|
75a61b |
+ return;
|
|
|
75a61b |
+ }
|
|
|
75a61b |
}
|
|
|
75a61b |
} else {
|
|
|
75a61b |
m[0] = 1; m[1] = 0;
|
|
|
75a61b |
--
|
|
|
75a61b |
2.1.0
|
|
|
75a61b |
|