poppler/GfxState.cc | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
New commits: commit e84338a44f27afb9872cb108fc29683b35ac55f7 Author: Albert Astals Cid <[email protected]> Date: Mon Nov 13 00:37:00 2017 +0100 GfxLabColorSpace::parse: Fix crash in broken documents Bug #103582 diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc index 3e30edf0..aeb9534f 100644 --- a/poppler/GfxState.cc +++ b/poppler/GfxState.cc @@ -1558,34 +1558,42 @@ GfxColorSpace *GfxLabColorSpace::parse(Array *arr, GfxState *state) { return NULL; } cs = new GfxLabColorSpace(); + bool ok = true; obj2 = obj1.dictLookup("WhitePoint"); if (obj2.isArray() && obj2.arrayGetLength() == 3) { Object obj3 = obj2.arrayGet(0); - cs->whiteX = obj3.getNum(); + cs->whiteX = obj3.getNum(&ok); obj3 = obj2.arrayGet(1); - cs->whiteY = obj3.getNum(); + cs->whiteY = obj3.getNum(&ok); obj3 = obj2.arrayGet(2); - cs->whiteZ = obj3.getNum(); + cs->whiteZ = obj3.getNum(&ok); } obj2 = obj1.dictLookup("BlackPoint"); if (obj2.isArray() && obj2.arrayGetLength() == 3) { Object obj3 = obj2.arrayGet(0); - cs->blackX = obj3.getNum(); + cs->blackX = obj3.getNum(&ok); obj3 = obj2.arrayGet(1); - cs->blackY = obj3.getNum(); + cs->blackY = obj3.getNum(&ok); obj3 = obj2.arrayGet(2); - cs->blackZ = obj3.getNum(); + cs->blackZ = obj3.getNum(&ok); } obj2 = obj1.dictLookup("Range"); if (obj2.isArray() && obj2.arrayGetLength() == 4) { Object obj3 = obj2.arrayGet(0); - cs->aMin = obj3.getNum(); + cs->aMin = obj3.getNum(&ok); obj3 = obj2.arrayGet(1); - cs->aMax = obj3.getNum(); + cs->aMax = obj3.getNum(&ok); obj3 = obj2.arrayGet(2); - cs->bMin = obj3.getNum(); + cs->bMin = obj3.getNum(&ok); obj3 = obj2.arrayGet(3); - cs->bMax = obj3.getNum(); + cs->bMax = obj3.getNum(&ok); + } + + if (!ok) { + error(errSyntaxWarning, -1, "Bad Lab color space"); + cs->transform = nullptr; + delete cs; + return nullptr; } cs->kr = 1 / (xyzrgb[0][0] * cs->whiteX + _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
