| Index: core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| diff --git a/core/fpdfapi/fpdf_parser/cpdf_parser.cpp b/core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| index c66647846d82d415c4cced6d96c1136da8d32e20..acf51de1eafcfc39c3845451a2438b78754756bf 100644
|
| --- a/core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| +++ b/core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| @@ -1077,13 +1077,8 @@
|
| FX_SAFE_UINT32 dwMaxObjNum = startnum;
|
| dwMaxObjNum += count;
|
| uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1;
|
| - if (!dwMaxObjNum.IsValid())
|
| + if (!dwMaxObjNum.IsValid() || dwMaxObjNum.ValueOrDie() > dwV5Size)
|
| continue;
|
| - // When the max object number is larger than the defined size, try to
|
| - // increase the size to accomodate more objects.
|
| - // Some software messes this up, see chromium:596947.
|
| - if (dwMaxObjNum.ValueOrDie() > dwV5Size)
|
| - ShrinkObjectMap(dwMaxObjNum.ValueOrDie());
|
|
|
| for (uint32_t j = 0; j < count; j++) {
|
| int32_t type = 1;
|
|
|