OLD | NEW |
1 // Copyright 2016 PDFium Authors. All rights reserved. | 1 // Copyright 2016 PDFium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com | 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com |
6 | 6 |
7 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h" | 7 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h" |
8 | 8 |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
(...skipping 1059 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1070 dwCaculatedSize *= totalWidth; | 1070 dwCaculatedSize *= totalWidth; |
1071 if (!dwCaculatedSize.IsValid() || | 1071 if (!dwCaculatedSize.IsValid() || |
1072 dwCaculatedSize.ValueOrDie() > dwTotalSize) { | 1072 dwCaculatedSize.ValueOrDie() > dwTotalSize) { |
1073 continue; | 1073 continue; |
1074 } | 1074 } |
1075 | 1075 |
1076 const uint8_t* segstart = pData + segindex * totalWidth; | 1076 const uint8_t* segstart = pData + segindex * totalWidth; |
1077 FX_SAFE_UINT32 dwMaxObjNum = startnum; | 1077 FX_SAFE_UINT32 dwMaxObjNum = startnum; |
1078 dwMaxObjNum += count; | 1078 dwMaxObjNum += count; |
1079 uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1; | 1079 uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1; |
1080 if (!dwMaxObjNum.IsValid() || dwMaxObjNum.ValueOrDie() > dwV5Size) | 1080 if (!dwMaxObjNum.IsValid()) |
1081 continue; | 1081 continue; |
| 1082 // When the max object number is larger than the defined size, try to |
| 1083 // increase the size to accomodate more objects. |
| 1084 // Some software messes this up, see chromium:596947. |
| 1085 if (dwMaxObjNum.ValueOrDie() > dwV5Size) |
| 1086 ShrinkObjectMap(dwMaxObjNum.ValueOrDie()); |
1082 | 1087 |
1083 for (uint32_t j = 0; j < count; j++) { | 1088 for (uint32_t j = 0; j < count; j++) { |
1084 int32_t type = 1; | 1089 int32_t type = 1; |
1085 const uint8_t* entrystart = segstart + j * totalWidth; | 1090 const uint8_t* entrystart = segstart + j * totalWidth; |
1086 if (WidthArray[0]) | 1091 if (WidthArray[0]) |
1087 type = GetVarInt(entrystart, WidthArray[0]); | 1092 type = GetVarInt(entrystart, WidthArray[0]); |
1088 | 1093 |
1089 if (GetObjectType(startnum + j) == 255) { | 1094 if (GetObjectType(startnum + j) == 255) { |
1090 FX_FILESIZE offset = | 1095 FX_FILESIZE offset = |
1091 GetVarInt(entrystart + WidthArray[0], WidthArray[1]); | 1096 GetVarInt(entrystart + WidthArray[0], WidthArray[1]); |
(...skipping 578 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1670 if (!LoadLinearizedAllCrossRefV4(m_LastXRefOffset, m_dwXrefStartObjNum) && | 1675 if (!LoadLinearizedAllCrossRefV4(m_LastXRefOffset, m_dwXrefStartObjNum) && |
1671 !LoadLinearizedAllCrossRefV5(m_LastXRefOffset)) { | 1676 !LoadLinearizedAllCrossRefV5(m_LastXRefOffset)) { |
1672 m_LastXRefOffset = 0; | 1677 m_LastXRefOffset = 0; |
1673 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; | 1678 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; |
1674 return FORMAT_ERROR; | 1679 return FORMAT_ERROR; |
1675 } | 1680 } |
1676 | 1681 |
1677 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; | 1682 m_pSyntax->m_MetadataObjnum = dwSaveMetadataObjnum; |
1678 return SUCCESS; | 1683 return SUCCESS; |
1679 } | 1684 } |
OLD | NEW |