| From 004e3c10df0abda214f0c293f9e269fdd979c5ee Mon Sep 17 00:00:00 2001 |
| From: Albert Astals Cid <aacid@kde.org> |
| Date: Wed, 18 Jul 2018 20:31:27 +0200 |
| Subject: Fix crash when Object has negative number |
| |
| Spec says object number has to be > 0 and gen has to be >= 0 |
| |
| Reported by email |
| |
| diff --git a/poppler/Parser.cc b/poppler/Parser.cc |
| index 39c9a967..8b0093e3 100644 |
| |
| |
| @@ -154,6 +154,11 @@ Object Parser::getObj(GBool simpleOnly, |
| const int gen = buf1.getInt(); |
| shift(); |
| shift(); |
| + |
| + if (unlikely(num <= 0 || gen < 0)) { |
| + return Object(); |
| + } |
| + |
| return Object(num, gen); |
| } else { |
| return Object(num); |