poppler/Lexer.cc |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

New commits:
commit 4181a0ff11195eb7a56d76be23994b843e20b483
Author: Albert Astals Cid <[email protected]>
Date:   Mon Aug 10 19:58:09 2009 +0200

    this branch is unlikely to happen

diff --git a/poppler/Lexer.cc b/poppler/Lexer.cc
index 40ba9ca..5962185 100644
--- a/poppler/Lexer.cc
+++ b/poppler/Lexer.cc
@@ -217,7 +217,7 @@ Object *Lexer::getObj(Object *obj, int objNum) {
     }
     if (neg)
       xi = -xi;
-    if (overflownInteger) {
+    if (unlikely(overflownInteger)) {
       obj->initError();
     } else {
       obj->initInt(xi);
commit 2a3025f32951ce7b7343aeef111902615d71595e
Author: Albert Astals Cid <[email protected]>
Date:   Mon Aug 10 19:55:40 2009 +0200

    fix overflow calculation not to depend on the variable overflowing

diff --git a/poppler/Lexer.cc b/poppler/Lexer.cc
index f6308b6..40ba9ca 100644
--- a/poppler/Lexer.cc
+++ b/poppler/Lexer.cc
@@ -30,6 +30,7 @@
 #include <stdlib.h>
 #include <stddef.h>
 #include <string.h>
+#include <limits.h>
 #include <ctype.h>
 #include "Lexer.h"
 #include "Error.h"
@@ -58,6 +59,8 @@ static const char specialChars[256] = {
   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0    // fx
 };
 
+static const int IntegerSafeLimit = (INT_MAX - 9) / 10;
+
 //------------------------------------------------------------------------
 // Lexer
 //------------------------------------------------------------------------
@@ -152,7 +155,7 @@ Object *Lexer::getObj(Object *obj, int objNum) {
   int c, c2;
   GBool comment, neg, done, overflownInteger;
   int numParen;
-  int xi, tmpxi;
+  int xi;
   double xf, scale;
   GooString *s;
   int n, m;
@@ -197,11 +200,12 @@ Object *Lexer::getObj(Object *obj, int objNum) {
        if (unlikely(overflownInteger)) {
          xf = xf * 10.0 + (c - '0');
        } else {
-         tmpxi = xi * 10 + (c - '0');
-         if (likely(tmpxi >= xi)) xi = tmpxi;
-         else {
+         if (unlikely(xi > IntegerSafeLimit) &&
+             (xi > (INT_MAX - (c - '0')) / 10.0)) {
            overflownInteger = gTrue;
            xf = xi * 10.0 + (c - '0');
+         } else {
+           xi = xi * 10 + (c - '0');
          }
        }
       } else if (c == '.') {
_______________________________________________
poppler mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/poppler

Reply via email to