Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(675)

Side by Side Diff: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Issue 1582193002: Loose checking for trailer's size field (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2014 PDFium Authors. All rights reserved. 1 // Copyright 2014 PDFium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
6 6
7 #include "core/include/fpdfapi/fpdf_parser.h" 7 #include "core/include/fpdfapi/fpdf_parser.h"
8 8
9 #include <algorithm> 9 #include <algorithm>
10 #include <memory> 10 #include <memory>
(...skipping 374 matching lines...) Expand 10 before | Expand all | Expand 10 after
385 FX_BOOL CPDF_Parser::LoadAllCrossRefV4(FX_FILESIZE xrefpos) { 385 FX_BOOL CPDF_Parser::LoadAllCrossRefV4(FX_FILESIZE xrefpos) {
386 if (!LoadCrossRefV4(xrefpos, 0, TRUE)) { 386 if (!LoadCrossRefV4(xrefpos, 0, TRUE)) {
387 return FALSE; 387 return FALSE;
388 } 388 }
389 m_pTrailer = LoadTrailerV4(); 389 m_pTrailer = LoadTrailerV4();
390 if (!m_pTrailer) { 390 if (!m_pTrailer) {
391 return FALSE; 391 return FALSE;
392 } 392 }
393 393
394 int32_t xrefsize = GetDirectInteger(m_pTrailer, "Size"); 394 int32_t xrefsize = GetDirectInteger(m_pTrailer, "Size");
395 if (xrefsize <= 0 || xrefsize > kMaxXRefSize) { 395 if (xrefsize > 0 && xrefsize <= kMaxXRefSize) {
396 return FALSE; 396 ShrinkObjectMap(xrefsize);
397 m_V5Type.SetSize(xrefsize);
397 } 398 }
398 ShrinkObjectMap(xrefsize); 399
399 m_V5Type.SetSize(xrefsize);
400 CFX_FileSizeArray CrossRefList; 400 CFX_FileSizeArray CrossRefList;
401 CFX_FileSizeArray XRefStreamList; 401 CFX_FileSizeArray XRefStreamList;
402 CrossRefList.Add(xrefpos); 402 CrossRefList.Add(xrefpos);
403 XRefStreamList.Add(GetDirectInteger(m_pTrailer, "XRefStm")); 403 XRefStreamList.Add(GetDirectInteger(m_pTrailer, "XRefStm"));
404 404
405 std::set<FX_FILESIZE> seen_xrefpos; 405 std::set<FX_FILESIZE> seen_xrefpos;
406 seen_xrefpos.insert(xrefpos); 406 seen_xrefpos.insert(xrefpos);
407 // When |m_pTrailer| doesn't have Prev entry or Prev entry value is not 407 // When |m_pTrailer| doesn't have Prev entry or Prev entry value is not
408 // numerical, GetDirectInteger() returns 0. Loading will end. 408 // numerical, GetDirectInteger() returns 0. Loading will end.
409 xrefpos = GetDirectInteger(m_pTrailer, "Prev"); 409 xrefpos = GetDirectInteger(m_pTrailer, "Prev");
(...skipping 4596 matching lines...) Expand 10 before | Expand all | Expand 10 after
5006 if (!m_pLinearizedDict) 5006 if (!m_pLinearizedDict)
5007 return -1; 5007 return -1;
5008 CPDF_Array* pRange = m_pLinearizedDict->GetArray("H"); 5008 CPDF_Array* pRange = m_pLinearizedDict->GetArray("H");
5009 if (!pRange) 5009 if (!pRange)
5010 return -1; 5010 return -1;
5011 CPDF_Object* pStreamLen = pRange->GetElementValue(1); 5011 CPDF_Object* pStreamLen = pRange->GetElementValue(1);
5012 if (!pStreamLen) 5012 if (!pStreamLen)
5013 return -1; 5013 return -1;
5014 return pStreamLen->GetInteger(); 5014 return pStreamLen->GetInteger();
5015 } 5015 }
OLDNEW
« no previous file with comments | « no previous file | fpdfsdk/src/fpdfview_embeddertest.cpp » ('j') | fpdfsdk/src/fpdfview_embeddertest.cpp » ('J')

Powered by Google App Engine
This is Rietveld 408576698