splash/SplashXPathScanner.cc | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
New commits: commit e126be08ea94d829a2d25aabb2ef79cc7bf65d4c Author: Albert Astals Cid <[email protected]> Date: Mon Jan 4 18:05:44 2021 +0100 SplashXPathScanner: If any of the segments of the path is nan, path is not valid Fixes crash in broken files #1022 diff --git a/splash/SplashXPathScanner.cc b/splash/SplashXPathScanner.cc index 62904121..98a49912 100644 --- a/splash/SplashXPathScanner.cc +++ b/splash/SplashXPathScanner.cc @@ -11,7 +11,7 @@ // All changes made under the Poppler project to this file are licensed // under GPL version 2 or later // -// Copyright (C) 2008, 2010, 2014, 2018, 2019 Albert Astals Cid <[email protected]> +// Copyright (C) 2008, 2010, 2014, 2018, 2019, 2021 Albert Astals Cid <[email protected]> // Copyright (C) 2010 Paweł Wiejacha <[email protected]> // Copyright (C) 2013, 2014 Thomas Freitag <[email protected]> // Copyright (C) 2018 Stefan Brüns <[email protected]> @@ -49,11 +49,13 @@ SplashXPathScanner::SplashXPathScanner(SplashXPath *xPathA, bool eoA, int clipYM partialClip = false; // compute the bbox - if (xPath->length == 0) { - xMin = yMin = 1; - xMax = yMax = 0; - } else { + xMin = yMin = 1; + xMax = yMax = 0; + if (xPath->length > 0) { seg = &xPath->segs[0]; + if (unlikely(std::isnan(seg->x0) || std::isnan(seg->x1) || std::isnan(seg->y0) || std::isnan(seg->y1))) { + return; + } if (seg->x0 <= seg->x1) { xMinFP = seg->x0; xMaxFP = seg->x1; @@ -70,6 +72,9 @@ SplashXPathScanner::SplashXPathScanner(SplashXPath *xPathA, bool eoA, int clipYM } for (i = 1; i < xPath->length; ++i) { seg = &xPath->segs[i]; + if (unlikely(std::isnan(seg->x0) || std::isnan(seg->x1) || std::isnan(seg->y0) || std::isnan(seg->y1))) { + return; + } if (seg->x0 < xMinFP) { xMinFP = seg->x0; } else if (seg->x0 > xMaxFP) { _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
