|
 |
db2a8b |
From 39a251b1b3a3343400a08e2f03c5518a26624626 Mon Sep 17 00:00:00 2001
|
|
|
db2a8b |
From: Adam Reichold <adam.reichold@t-online.de>
|
|
|
db2a8b |
Date: Mon, 24 Dec 2018 15:40:38 +0100
|
|
|
db2a8b |
Subject: [PATCH] Do not try to parse into unallocated XRef entry and return
|
|
|
db2a8b |
pointer to dummy entry instead. Closes #692 and oss-fuzz/12330
|
|
|
db2a8b |
|
|
|
db2a8b |
---
|
|
|
db2a8b |
poppler/XRef.cc | 27 +++++++++++++++++++++------
|
|
|
db2a8b |
1 file changed, 21 insertions(+), 6 deletions(-)
|
|
|
db2a8b |
|
|
|
db2a8b |
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
|
|
|
db2a8b |
index 0ec66944..d042d1f4 100644
|
|
|
db2a8b |
--- a/poppler/XRef.cc
|
|
|
db2a8b |
+++ b/poppler/XRef.cc
|
|
|
db2a8b |
@@ -1548,11 +1548,31 @@ void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
|
|
|
db2a8b |
}
|
|
|
db2a8b |
}
|
|
|
db2a8b |
|
|
|
db2a8b |
+namespace {
|
|
|
db2a8b |
+
|
|
|
db2a8b |
+struct DummyXRefEntry : XRefEntry {
|
|
|
db2a8b |
+ DummyXRefEntry() {
|
|
|
db2a8b |
+ offset = 0;
|
|
|
db2a8b |
+ gen = -1;
|
|
|
db2a8b |
+ type = xrefEntryNone;
|
|
|
db2a8b |
+ flags = 0;
|
|
|
db2a8b |
+ }
|
|
|
db2a8b |
+};
|
|
|
db2a8b |
+
|
|
|
db2a8b |
+DummyXRefEntry dummyXRefEntry;
|
|
|
db2a8b |
+
|
|
|
db2a8b |
+}
|
|
|
db2a8b |
+
|
|
|
db2a8b |
XRefEntry *XRef::getEntry(int i, GBool complainIfMissing)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
if (i >= size || entries[i].type == xrefEntryNone) {
|
|
|
db2a8b |
|
|
|
db2a8b |
if ((!xRefStream) && mainXRefEntriesOffset) {
|
|
|
db2a8b |
+ if (unlikely(i >= capacity)) {
|
|
|
db2a8b |
+ error(errInternal, -1, "Request for out-of-bounds XRef entry [{0:d}]", i);
|
|
|
db2a8b |
+ return &dummyXRefEntry;
|
|
|
db2a8b |
+ }
|
|
|
db2a8b |
+
|
|
|
db2a8b |
if (!parseEntry(mainXRefEntriesOffset + 20*i, &entries[i])) {
|
|
|
db2a8b |
error(errSyntaxError, -1, "Failed to parse XRef entry [{0:d}].", i);
|
|
|
db2a8b |
}
|
|
|
db2a8b |
@@ -1563,12 +1583,7 @@ XRefEntry *XRef::getEntry(int i, bool complainIfMissing)
|
|
|
db2a8b |
// We might have reconstructed the xref
|
|
|
db2a8b |
// Check again i is in bounds
|
|
|
db2a8b |
if (unlikely(i >= size)) {
|
|
|
db2a8b |
- static XRefEntry dummy;
|
|
|
db2a8b |
- dummy.offset = 0;
|
|
|
db2a8b |
- dummy.gen = -1;
|
|
|
db2a8b |
- dummy.type = xrefEntryNone;
|
|
|
db2a8b |
- dummy.flags = 0;
|
|
|
db2a8b |
- return &dummy;
|
|
|
db2a8b |
+ return &dummyXRefEntry;
|
|
|
db2a8b |
}
|
|
|
db2a8b |
|
|
|
db2a8b |
if (entries[i].type == xrefEntryNone) {
|
|
|
db2a8b |
--
|
|
|
db2a8b |
2.20.1
|
|
|
db2a8b |
|