poppler/XRef.cc | 11 +++++++++++ utils/HtmlOutputDev.cc | 18 ++++++++++-------- 2 files changed, 21 insertions(+), 8 deletions(-)
New commits: commit 2f1e7ef252b8d1f7ee6004825c2926f0f5e181a5 Author: Albert Astals Cid <[email protected]> Date: Thu Apr 12 23:11:41 2012 +0200 Do not crash in broken documents They might trigger an xref reconstruct and then i could not be in bounds anymore Crash found by Joel Voss of Leviathan Security Group diff --git a/poppler/XRef.cc b/poppler/XRef.cc index 60c2f9d..80ce17f 100644 --- a/poppler/XRef.cc +++ b/poppler/XRef.cc @@ -1358,6 +1358,17 @@ XRefEntry *XRef::getEntry(int i) break; } } + + // We might have reconstructed the xref + // Check again i is in bounds + if (unlikely(i >= size)) { + static XRefEntry dummy; + dummy.offset = 0; + dummy.gen = -1; + dummy.type = xrefEntryNone; + dummy.updated = false; + return &dummy; + } if (entries[i].type == xrefEntryNone) { error(errSyntaxError, -1, "Invalid XRef entry"); commit 19fb9caecb1b265a8b8651e9bcf4b779f593fefd Author: Albert Astals Cid <[email protected]> Date: Thu Apr 12 22:24:50 2012 +0200 Fix crash when the destination file does not exist Issue found by Joel Voss of Leviathan Security Group diff --git a/utils/HtmlOutputDev.cc b/utils/HtmlOutputDev.cc index bd8c642..2f07988 100644 --- a/utils/HtmlOutputDev.cc +++ b/utils/HtmlOutputDev.cc @@ -1222,14 +1222,16 @@ HtmlOutputDev::~HtmlOutputDev() { fputs("</BODY>\n</HTML>\n",fContentsFrame); fclose(fContentsFrame); } - if (xml) { - fputs("</pdf2xml>\n",page); - fclose(page); - } else - if ( !complexMode || xml || noframes ) - { - fputs("</BODY>\n</HTML>\n",page); - fclose(page); + if (page != NULL) { + if (xml) { + fputs("</pdf2xml>\n",page); + fclose(page); + } else + if ( !complexMode || xml || noframes ) + { + fputs("</BODY>\n</HTML>\n",page); + fclose(page); + } } if (pages) delete pages; _______________________________________________ poppler mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/poppler
