| OLD | NEW |
| 1 // Copyright 2016 PDFium Authors. All rights reserved. | 1 // Copyright 2016 PDFium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com | 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com |
| 6 | 6 |
| 7 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h" | 7 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h" |
| 8 | 8 |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| (...skipping 1059 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1070 dwCaculatedSize *= totalWidth; | 1070 dwCaculatedSize *= totalWidth; |
| 1071 if (!dwCaculatedSize.IsValid() || | 1071 if (!dwCaculatedSize.IsValid() || |
| 1072 dwCaculatedSize.ValueOrDie() > dwTotalSize) { | 1072 dwCaculatedSize.ValueOrDie() > dwTotalSize) { |
| 1073 continue; | 1073 continue; |
| 1074 } | 1074 } |
| 1075 | 1075 |
| 1076 const uint8_t* segstart = pData + segindex * totalWidth; | 1076 const uint8_t* segstart = pData + segindex * totalWidth; |
| 1077 FX_SAFE_UINT32 dwMaxObjNum = startnum; | 1077 FX_SAFE_UINT32 dwMaxObjNum = startnum; |
| 1078 dwMaxObjNum += count; | 1078 dwMaxObjNum += count; |
| 1079 uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1; | 1079 uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1; |
| 1080 if (!dwMaxObjNum.IsValid()) | 1080 if (!dwMaxObjNum.IsValid() || dwMaxObjNum.ValueOrDie() > dwV5Size) |
| 1081 continue; | 1081 continue; |
| 1082 // When the max object number is larger than the defined size, try to | |
| 1083 // increase the size to accomodate more objects. | |
| 1084 // Some software messes this up, see chromium:596947. | |
| 1085 if (dwMaxObjNum.ValueOrDie() > dwV5Size) | |
| 1086 ShrinkObjectMap(dwMaxObjNum.ValueOrDie()); | |
| 1087 | 1082 |
| 1088 for (uint32_t j = 0; j < count; j++) { | 1083 for (uint32_t j = 0; j < count; j++) { |
| 1089 int32_t type = 1; | 1084 int32_t type = 1; |
| 1090 const uint8_t* entrystart = segstart + j * totalWidth; | 1085 const uint8_t* entrystart = segstart + j * totalWidth; |
| 1091 if (WidthArray[0]) | 1086 if (WidthArray[0]) |
| 1092 type = GetVarInt(entrystart, WidthArray[0]); | 1087 type = GetVarInt(entrystart, WidthArray[0]); |
| 1093 | 1088 |
| 1094 if (GetObjectType(startnum + j) == 255) { | 1089 if (GetObjectType(startnum + j) == 255) { |
| 1095 FX_FILESIZE offset = | 1090 FX_FILESIZE offset = |
| 1096 GetVarInt(entrystart + WidthArray[0], WidthArray[1]); | 1091 GetVarInt(entrystart + WidthArray[0], WidthArray[1]); |
| (...skipping 578 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1675 if (!LoadLinearizedAllCrossRefV4(m_LastXRefOffset, m_dwXrefStartObjNum) && | 1670 if (!LoadLinearizedAllCrossRefV4(m_LastXRefOffset, m_dwXrefStartObjNum) && |
| 1676 !LoadLinearizedAllCrossRefV5(m_LastXRefOffset)) { | 1671 !LoadLinearizedAllCrossRefV5(m_LastXRefOffset)) { |
| 1677 m_LastXRefOffset = 0; | 1672 m_LastXRefOffset = 0; |
| 1678 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; | 1673 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; |
| 1679 return FORMAT_ERROR; | 1674 return FORMAT_ERROR; |
| 1680 } | 1675 } |
| 1681 | 1676 |
| 1682 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; | 1677 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; |
| 1683 return SUCCESS; | 1678 return SUCCESS; |
| 1684 } | 1679 } |
| OLD | NEW |