2e1d9e
From 7f87dc10b6adccd6d1b977a28b064add254aa2da Mon Sep 17 00:00:00 2001
2e1d9e
From: Adam Reichold <adam.reichold@t-online.de>
2e1d9e
Date: Thu, 27 Dec 2018 11:54:53 +0100
2e1d9e
Subject: [PATCH] Do not try to construct invalid rich media annotation assets.
2e1d9e
 Closes #703
2e1d9e
2e1d9e
---
2e1d9e
 poppler/Annot.cc | 24 +++++++++++++-----------
2e1d9e
 1 file changed, 13 insertions(+), 11 deletions(-)
2e1d9e
2e1d9e
diff --git a/poppler/Annot.cc b/poppler/Annot.cc
2e1d9e
index 2e4770ab..1750dc70 100644
2e1d9e
--- a/poppler/Annot.cc
2e1d9e
+++ b/poppler/Annot.cc
2e1d9e
@@ -6418,20 +6418,22 @@ AnnotRichMedia::Content::Content(Dict *dict) {
2e1d9e
   if (obj1.isDict()) {
2e1d9e
     Object obj2 = obj1.getDict()->lookup("Names");
2e1d9e
     if (obj2.isArray()) {
2e1d9e
-      nAssets = obj2.arrayGetLength() / 2;
2e1d9e
+      const int length = obj2.arrayGetLength() / 2;
2e1d9e
 
2e1d9e
-      assets = (Asset **)gmallocn(nAssets, sizeof(Asset *));
2e1d9e
+      assets = (Asset **)gmallocn(length, sizeof(Asset *));
2e1d9e
+      for (int i = 0; i < length; ++i) {
2e1d9e
+	Object objKey = obj2.arrayGet(2 * i);
2e1d9e
+	Object objVal = obj2.arrayGet(2 * i + 1);
2e1d9e
 
2e1d9e
-      int counter = 0;
2e1d9e
-      for (int i = 0; i < nAssets; ++i) {
2e1d9e
-        assets[counter] = new AnnotRichMedia::Asset;
2e1d9e
-
2e1d9e
-        Object objKey = obj2.arrayGet(i * 2);
2e1d9e
-        assets[counter]->fileSpec = obj2.arrayGet(i * 2 + 1);
2e1d9e
-
2e1d9e
-        assets[counter]->name = new GooString( objKey.getString() );
2e1d9e
-        ++counter;
2e1d9e
+	if (!objKey.isString() || objVal.isNull()) {
2e1d9e
+	  error(errSyntaxError, -1, "Bad Annot Asset");
2e1d9e
+	  continue;
2e1d9e
+	}
2e1d9e
 
2e1d9e
+	assets[nAssets] = new AnnotRichMedia::Asset;
2e1d9e
+	assets[nAssets]->name = new GooString( objKey.getString() );
2e1d9e
+	assets[nAssets]->fileSpec = std::move(objVal);
2e1d9e
+	++nAssets;
2e1d9e
       }
2e1d9e
     }
2e1d9e
   }
2e1d9e
-- 
2e1d9e
2.20.1
2e1d9e