poppler/Function.cc | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit b3425dd3261679958cd56c0f71995c15d2124433
Author: Albert Astals Cid <[email protected]>
Date: Tue Dec 22 22:50:33 2015 +0100
Do not crash on invalid files
Bug #93476
diff --git a/poppler/Function.cc b/poppler/Function.cc
index 67283df..ee5afc1 100644
--- a/poppler/Function.cc
+++ b/poppler/Function.cc
@@ -577,6 +577,10 @@ ExponentialFunction::ExponentialFunction(Object *funcObj,
Dict *dict) {
goto err2;
}
n = obj1.arrayGetLength();
+ if (unlikely(n > funcMaxOutputs)) {
+ error(errSyntaxError, -1, "Function's C0 array is wrong length");
+ n = funcMaxOutputs;
+ }
for (i = 0; i < n; ++i) {
obj1.arrayGet(i, &obj2);
if (!obj2.isNum()) {
_______________________________________________
poppler mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/poppler
