[gs-commits] mupdf 1.16.1.1 Bug 701310: Refuse to create objects with
[email protected] (Robin Watts)
| Newsgroups | gmane.comp.printing.ghostscript.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit 01226d0c092b4f1ac6c06cb574e628764e53577b Author: Robin Watts <[email protected]> Date: Mon Aug 12 10:46:01 2019 +0100 Bug 701310: Refuse to create objects with negative obj/gen nums. This avoids problems when cleaning the files. diff --git a/include/mupdf/pdf/object.h b/include/mupdf/pdf/object.h index 1e5fcf6..7393a18 100644 --- a/include/mupdf/pdf/object.h +++ b/include/mupdf/pdf/object.h @@ -6,6 +6,7 @@ typedef struct pdf_crypt_s pdf_crypt; /* Defined in PDF 1.7 according to Acrobat limit. */ #define PDF_MAX_OBJECT_NUMBER 8388607 +#define PDF_MAX_GEN_NUMBER 65535 /* * Dynamic objects. diff --git a/source/pdf/pdf-object.c b/source/pdf/pdf-object.c index 06e3933..7a541a8 100644 --- a/source/pdf/pdf-object.c +++ b/source/pdf/pdf-object.c @@ -179,6 +179,10 @@ pdf_obj * pdf_new_indirect(fz_context *ctx, pdf_document *doc, int num, int gen) { pdf_obj_ref *obj; + if (num < 0 || num > PDF_MAX_OBJECT_NUMBER) + fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid object number (%d)", num); + if (gen < 0 || gen > PDF_MAX_GEN_NUMBER) + fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen); obj = Memento_label(fz_malloc(ctx, sizeof(pdf_obj_ref)), "pdf_obj(indirect)"); obj->super.refs = 1; obj->super.kind = PDF_INDIRECT; http://git.ghostscript.com/?p=mupdf.git;a=commit;h=01226d0c092b4f1ac6c06cb574e628764e53577b -- MuPDF library Artifex Software, Inc.