poppler/Annot.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
New commits: commit c0e87eda688351b3caf222e5525f75a3190fd87c Author: Albert Astals Cid <aa...@kde.org> Date: Sun Jun 24 11:15:52 2018 +0200 AnnotBorder::parseDashArray: Fix correct calculation obj not being a num also means not correct fixes oss-fuzz/9056 diff --git a/poppler/Annot.cc b/poppler/Annot.cc index d5a66524..d37824c1 100644 --- a/poppler/Annot.cc +++ b/poppler/Annot.cc @@ -522,16 +522,18 @@ AnnotBorder::AnnotBorder() { GBool AnnotBorder::parseDashArray(Object *dashObj) { GBool correct = gTrue; - int tempLength = dashObj->arrayGetLength(); + const int tempLength = dashObj->arrayGetLength(); double *tempDash = (double *) gmallocn (tempLength, sizeof (double)); // TODO: check not all zero (Line Dash Pattern Page 217 PDF 8.1) for (int i = 0; i < tempLength && i < DASH_LIMIT && correct; i++) { - Object obj1 = dashObj->arrayGet(i); + const Object obj1 = dashObj->arrayGet(i); if (obj1.isNum()) { tempDash[i] = obj1.getNum(); correct = tempDash[i] >= 0; + } else { + correct = gFalse; } } _______________________________________________ poppler mailing list poppler@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/poppler