1d3252
commit d6ea8acbb348fdb43601a963ba5407e933565003
1d3252
Author: Adrian Johnson <ajohnson@redneon.com>
1d3252
Date:   Mon Nov 3 19:11:25 2014 +0100
1d3252
1d3252
    fix crash in Xref::getEntry
1d3252
    
1d3252
    Bug 85234
1d3252
1d3252
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
1d3252
index 2560e3d..333f5ec 100644
1d3252
--- a/poppler/XRef.cc
1d3252
+++ b/poppler/XRef.cc
1d3252
@@ -1568,7 +1568,7 @@ GBool XRef::parseEntry(Goffset offset, XRefEntry *entry)
1d3252
 void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
1d3252
 {
1d3252
   std::vector<goffset> followedPrev;
1d3252
-  while (prevXRefOffset && (untilEntryNum == -1 || entries[untilEntryNum].type == xrefEntryNone)) {
1d3252
+  while (prevXRefOffset && (untilEntryNum == -1 || (untilEntryNum < size && entries[untilEntryNum].type == xrefEntryNone))) {
1d3252
     bool followed = false;
1d3252
     for (size_t j = 0; j < followedPrev.size(); j++) {
1d3252
       if (followedPrev.at(j) == prevXRefOffset) {
1d3252
@@ -1606,7 +1606,7 @@ void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
1d3252
 
1d3252
 XRefEntry *XRef::getEntry(int i, GBool complainIfMissing)
1d3252
 {
1d3252
-  if (entries[i].type == xrefEntryNone) {
1d3252
+  if (i >= size || entries[i].type == xrefEntryNone) {
1d3252
 
1d3252
     if ((!xRefStream) && mainXRefEntriesOffset) {
1d3252
       if (!parseEntry(mainXRefEntriesOffset + 20*i, &entries[i])) {