poppler/Linearization.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
New commits: commit 545a8f7cb0a473706858d2851f968ffadcc78ed0 Author: Jason Crain <[email protected]> Date: Mon Aug 24 01:12:01 2015 +0200 Fix bounds check in Linearization::getPageFirst Make sure Linearization::pageFirst is in the interval [0, getNumPages), otherwise Hints::getPageObjectNum() can have an out of bounds read. Bug #91200 diff --git a/poppler/Linearization.cc b/poppler/Linearization.cc index 33331d1..be041f9 100644 --- a/poppler/Linearization.cc +++ b/poppler/Linearization.cc @@ -5,6 +5,7 @@ // This file is licensed under the GPLv2 or later // // Copyright 2010, 2012 Hib Eris <[email protected]> +// Copyright 2015 Jason Crain <[email protected]> // //======================================================================== @@ -211,7 +212,7 @@ int Linearization::getPageFirst() linDict.getDict()->lookupInt("P", NULL, &pageFirst); } - if ((pageFirst < 0) || (pageFirst > getNumPages())) { + if ((pageFirst < 0) || (pageFirst >= getNumPages())) { error(errSyntaxWarning, -1, "First page in linearization table is invalid"); return 0; } _______________________________________________ poppler mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/poppler
