poppler/StructTreeRoot.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
New commits: commit 5d0c23a9f6cdc3fd216335124788958f46932158 Author: Jan-Erik S <[email protected]> Date: Sat Jul 29 18:23:39 2017 +0200 Fix crash in broken document diff --git a/poppler/StructTreeRoot.cc b/poppler/StructTreeRoot.cc index e46e3e28..29beeecc 100644 --- a/poppler/StructTreeRoot.cc +++ b/poppler/StructTreeRoot.cc @@ -67,13 +67,13 @@ void StructTreeRoot::parse(Dict *root) index.free(); continue; } - if (index.getInt() < 0) { - error(errSyntaxError, -1, "Nums item at position {0:d} is invalid value ({1:d})", i, index.getInt()); + const unsigned idx = index.getInt(); + if (idx < 0 || idx >= parentTree.size()) { + error(errSyntaxError, -1, "Nums item at position {0:d} is invalid value ({1:d}): [0..{2:d}]", i, idx, parentTree.size() - 1); index.free(); continue; } - const unsigned idx = index.getInt(); if (nums.arrayGetNF(i + 1, &value)->isRef()) { parentTree[idx].resize(1); parentTree[idx][0].ref = value.getRef(); _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
