xpdf303: Check xrefEntryCompressed entries to be of correct type and in bounds

1 files changed, 0 insertions, 16 deletions

diff --git a/ALL_DIFF b/ALL_DIFF
index f71693e..7def1c9 100644
--- a/ALL_DIFF
+++ b/ALL_DIFF
@@ -20239,22 +20239,6 @@ diff -ru xpdf-3.02/xpdf/XRef.cc xpdf-3.03/xpdf/XRef.cc
      obj2.free();

      obj3.free();

 @@ -829,14 +864,26 @@

-     break;

- 

-   case xrefEntryCompressed:

-#if 0 // Adobe apparently ignores the generation number on compressed objects

-     if (gen != 0) {

-       goto err;

-     }

-#endif

-+    if (e->offset >= (Guint)size ||

-+	entries[e->offset].type != xrefEntryUncompressed) {

-+      error(errSyntaxError, -1, "Invalid object stream");

-+      goto err;

-+    }

-@@ -884,13 +931,16 @@

- }

- 

  Guint XRef::strToUnsigned(char *s) {

 -  Guint x;

 +  Guint x, d;