75a61b
commit d6ea8acbb348fdb43601a963ba5407e933565003
75a61b
Author: Adrian Johnson <ajohnson@redneon.com>
75a61b
Date:   Mon Nov 3 19:11:25 2014 +0100
75a61b
75a61b
    fix crash in Xref::getEntry
75a61b
    
75a61b
    Bug 85234
75a61b
75a61b
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
75a61b
index 2560e3d..333f5ec 100644
75a61b
--- a/poppler/XRef.cc
75a61b
+++ b/poppler/XRef.cc
75a61b
@@ -1568,7 +1568,7 @@ GBool XRef::parseEntry(Goffset offset, XRefEntry *entry)
75a61b
 void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
75a61b
 {
75a61b
   std::vector<Goffset> followedPrev;
75a61b
-  while (prevXRefOffset && (untilEntryNum == -1 || entries[untilEntryNum].type == xrefEntryNone)) {
75a61b
+  while (prevXRefOffset && (untilEntryNum == -1 || (untilEntryNum < size && entries[untilEntryNum].type == xrefEntryNone))) {
75a61b
     bool followed = false;
75a61b
     for (size_t j = 0; j < followedPrev.size(); j++) {
75a61b
       if (followedPrev.at(j) == prevXRefOffset) {
75a61b
@@ -1606,7 +1606,7 @@ void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
75a61b
 
75a61b
 XRefEntry *XRef::getEntry(int i, GBool complainIfMissing)
75a61b
 {
75a61b
-  if (entries[i].type == xrefEntryNone) {
75a61b
+  if (i >= size || entries[i].type == xrefEntryNone) {
75a61b
 
75a61b
     if ((!xRefStream) && mainXRefEntriesOffset) {
75a61b
       if (!parseEntry(mainXRefEntriesOffset + 20*i, &entries[i])) {