poppler/Gfx.cc | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
New commits: commit 0b1cd9403b8a240e58ec4f1832588d25f8295278 Author: Jason Crain <[email protected]> Date: Sat Dec 20 03:22:23 2014 -0600 Free BBox object on error diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc index 77693f9..6ad1b2c 100644 --- a/poppler/Gfx.cc +++ b/poppler/Gfx.cc @@ -5278,6 +5278,7 @@ void Gfx::drawAnnot(Object *str, AnnotBorder *border, AnnotColor *aColor, obj1.free(); } else { obj1.free(); + bboxObj.free(); error(errSyntaxError, getPos(), "Bad form bounding box value"); return; } commit acc33a6950031ac4a5c759d043d24df0cfa7e8b6 Author: Jason Crain <[email protected]> Date: Sat Dec 20 02:24:49 2014 -0600 Check for invalid matrix in annotation Bug #84990 diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc index 64a9d7b..77693f9 100644 --- a/poppler/Gfx.cc +++ b/poppler/Gfx.cc @@ -37,6 +37,7 @@ // Copyright (C) 2012 Even Rouault <[email protected]> // Copyright (C) 2012, 2013 Fabio D'Urso <[email protected]> // Copyright (C) 2012 Lu Wang <[email protected]> +// Copyright (C) 2014 Jason Crain <[email protected]> // // To see a description of the changes please see the Changelog file that // came with your tarball or type make ChangeLog if you are building from git @@ -5288,8 +5289,15 @@ void Gfx::drawAnnot(Object *str, AnnotBorder *border, AnnotColor *aColor, if (matrixObj.isArray() && matrixObj.arrayGetLength() >= 6) { for (i = 0; i < 6; ++i) { matrixObj.arrayGet(i, &obj1); - m[i] = obj1.getNum(); - obj1.free(); + if (likely(obj1.isNum())) { + m[i] = obj1.getNum(); + obj1.free(); + } else { + obj1.free(); + matrixObj.free(); + error(errSyntaxError, getPos(), "Bad form matrix"); + return; + } } } else { m[0] = 1; m[1] = 0; _______________________________________________ poppler mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/poppler
