Issue 1110653002: SEGV in CFX_BaseSegmentedArray::Iterate() when CS has malformed dictionary.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Issue 1110653002: SEGV in CFX_BaseSegmentedArray::Iterate() when CS has malformed dictionary. (Closed)

Created:
5 years, 8 months ago by Tom Sepez

Modified:
5 years, 8 months ago

Reviewers:
Lei Zhang, palmer

CC:
pdfium-reviews_googlegroups.com, palmer

Base URL:
https://pdfium.googlesource.com/pdfium.git@master

Target Ref:
refs/heads/master

Visibility:
Public.

SEGV in CFX_BaseSegmentedArray::Iterate() when CS has malformed dictionary. Failure to check document-controlled value before using it. BUG=481363 R=palmer@chromium.org, thestig@chromium.org Committed: https://pdfium.googlesource.com/pdfium/+/bb93b0ba5b3c430d3b996e2c009d48feb17a44c3

Created: 5 years, 8 months ago

Download [raw] [tar.bz2]

	Unified diffs	Side-by-side diffs	Delta from patch set	Stats (+122 lines, -0 lines)			Patch
M	core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp	View	1	1 chunk	+3 lines, -0 lines	0 comments	Download
M	core/src/fpdfapi/fpdf_parser/fpdf_parser_parser_embeddertest.cpp	View		1 chunk	+5 lines, -0 lines	0 comments	Download
A	testing/resources/bug_481363.in	View		1 chunk	+52 lines, -0 lines	0 comments	Download
A	testing/resources/bug_481363.pdf	View	1	1 chunk	+62 lines, -0 lines	0 comments	Download

Total messages: 6 (2 generated)

Tom Sepez

5 years, 8 months ago (2015-04-27 20:24:07 UTC) #6

Message was sent while issue was closed.

Committed patchset #2 (id:20001) manually as
bb93b0ba5b3c430d3b996e2c009d48feb17a44c3 (presubmit successful).