qt5/src/poppler-link.cc |   24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

New commits:
commit 0eb28e216fc45fe5ceed1c093a541ceca0dc0397
Author: Christoph Cullmann <cullm...@kde.org>
Date:   Fri Jan 13 00:03:27 2017 +0100

    qt5: Fix segfault/assert if LinkDestination is constructed with invalid 
input string.
    
    Bug #99357

diff --git a/qt5/src/poppler-link.cc b/qt5/src/poppler-link.cc
index 477f228..ae2878e 100644
--- a/qt5/src/poppler-link.cc
+++ b/qt5/src/poppler-link.cc
@@ -296,17 +296,19 @@ class LinkMoviePrivate : public LinkPrivate
        LinkDestination::LinkDestination(const QString &description)
                : d( new LinkDestinationPrivate )
        {
-               QStringList tokens = description.split( ';' );
-               d->kind = static_cast<Kind>(tokens.at(0).toInt());
-               d->pageNum = tokens.at(1).toInt();
-               d->left = tokens.at(2).toDouble();
-               d->bottom = tokens.at(3).toDouble();
-               d->right = tokens.at(4).toDouble();
-               d->top = tokens.at(5).toDouble();
-               d->zoom = tokens.at(6).toDouble();
-               d->changeLeft = static_cast<bool>(tokens.at(7).toInt());
-               d->changeTop = static_cast<bool>(tokens.at(8).toInt());
-               d->changeZoom = static_cast<bool>(tokens.at(9).toInt());
+               const QStringList tokens = description.split( ';' );
+               if (tokens.size() >= 10) {
+                       d->kind = static_cast<Kind>(tokens.at(0).toInt());
+                       d->pageNum = tokens.at(1).toInt();
+                       d->left = tokens.at(2).toDouble();
+                       d->bottom = tokens.at(3).toDouble();
+                       d->right = tokens.at(4).toDouble();
+                       d->top = tokens.at(5).toDouble();
+                       d->zoom = tokens.at(6).toDouble();
+                       d->changeLeft = static_cast<bool>(tokens.at(7).toInt());
+                       d->changeTop = static_cast<bool>(tokens.at(8).toInt());
+                       d->changeZoom = static_cast<bool>(tokens.at(9).toInt());
+               }
        }
        
        LinkDestination::LinkDestination(const LinkDestination &other)
_______________________________________________
poppler mailing list
poppler@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/poppler

Reply via email to