| Index: core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| diff --git a/core/fpdfapi/fpdf_parser/cpdf_parser.cpp b/core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| index acf51de1eafcfc39c3845451a2438b78754756bf..c66647846d82d415c4cced6d96c1136da8d32e20 100644
|
| --- a/core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| +++ b/core/fpdfapi/fpdf_parser/cpdf_parser.cpp
|
| @@ -1077,8 +1077,13 @@
|
| FX_SAFE_UINT32 dwMaxObjNum = startnum;
|
| dwMaxObjNum += count;
|
| uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1;
|
| - if (!dwMaxObjNum.IsValid() || dwMaxObjNum.ValueOrDie() > dwV5Size)
|
| + if (!dwMaxObjNum.IsValid())
|
| continue;
|
| + // When the max object number is larger than the defined size, try to
|
| + // increase the size to accomodate more objects.
|
| + // Some software messes this up, see chromium:596947.
|
| + if (dwMaxObjNum.ValueOrDie() > dwV5Size)
|
| + ShrinkObjectMap(dwMaxObjNum.ValueOrDie());
|
|
|
| for (uint32_t j = 0; j < count; j++) {
|
| int32_t type = 1;
|
|
|