poppler/Form.cc | 4 ++++ 1 file changed, 4 insertions(+) New commits: commit a4ca3a96a6b1f65b335a1ea362e6c202e46ae055 Author: Albert Astals Cid <aa...@kde.org> Date: Wed Oct 19 15:51:43 2022 +0200
topIdx can't be negative Fixes crash on broken files. Issue #1303 diff --git a/poppler/Form.cc b/poppler/Form.cc index 4dfba6dd..d33160b3 100644 --- a/poppler/Form.cc +++ b/poppler/Form.cc @@ -1845,6 +1845,10 @@ FormFieldChoice::FormFieldChoice(PDFDoc *docA, Object &&aobj, const Ref refA, Fo obj1 = dict->lookup("TI"); if (obj1.isInt()) { topIdx = obj1.getInt(); + if (topIdx < 0) { + error(errSyntaxError, -1, "FormFieldChoice:: invalid topIdx entry\n"); + topIdx = 0; + } } obj1 = Form::fieldLookup(dict, "Opt");