Previous Revision: d18bc728e46c5a5708f14d27c2b6c44e1d0c3232
Current Revision: 520cc26d18c9ee245b56e9e91f9d4fcae02be5f0
commit 520cc26d18c9ee245b56e9e91f9d4fcae02be5f0
Author: Robin Watts <[email protected]>
AuthorDate: Tue Nov 7 19:21:58 2017 +0000
CommitDate: Wed Nov 8 09:36:23 2017 +0000
Bug 689699: Avoid buffer overrun.
When cleaning a pdf file, various lists (of pdf_xref_len length) are
defined early on.
If we trigger a repair during the clean, this can cause pdf_xref_len
to increase causing an overrun.
Fix this by watching for changes in the length, and checking accesses
to the list for validity.
This also appears to fix bugs 698700-698703.
source/pdf/pdf-write.c
muPDF:
new gcc warnings (gcc (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609):
source/pdf/pdf-write.c:2731:6: warning: unused variable 'num' [-Wunused-variable]
http://miles.ghostscript.com:8080/artifex/mupdf/520cc26d18c9ee245b56e9e91f9d4fcae02be5f0/mupdf-gcc-warnings.txt
new cppcheck warnings (Cppcheck 1.72):
source/pdf/pdf-write.c:1810: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Type),pdf_name_eq(ctx,o,PDF_NAME_XObject)' depends on order of evaluation of side effects
source/pdf/pdf-write.c:1811: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Subtype),pdf_name_eq(ctx,o,PDF_NAME_Image)' depends on order of evaluation of side effects
source/pdf/pdf-write.c:1813: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Filter),filter_implies_image(ctx,o)' depends on order of evaluation of side effects
source/pdf/pdf-write.c:1823: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Type),pdf_name_eq(ctx,o,PDF_NAME_Font)' depends on order of evaluation of side effects
source/pdf/pdf-write.c:1825: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Type),pdf_name_eq(ctx,o,PDF_NAME_FontDescriptor)' depends on order of evaluation of side effects
source/pdf/pdf-write.c:1833: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Subtype),pdf_name_eq(ctx,o,PDF_NAME_Type1C)' depends on order of evaluation of side effects
source/pdf/pdf-write.c:1835: error: Expression 'o=pdf_dict_get(ctx,obj,PDF_NAME_Subtype),pdf_name_eq(ctx,o,PDF_NAME_CIDFontType0C)' depends on order of evaluation of side effects
http://miles.ghostscript.com:8080/artifex/mupdf/520cc26d18c9ee245b56e9e91f9d4fcae02be5f0/mupdf-cppcheck.txt
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.