Index: core/fpdfapi/fpdf_parser/cpdf_parser.cpp |
diff --git a/core/fpdfapi/fpdf_parser/cpdf_parser.cpp b/core/fpdfapi/fpdf_parser/cpdf_parser.cpp |
index acf51de1eafcfc39c3845451a2438b78754756bf..c66647846d82d415c4cced6d96c1136da8d32e20 100644 |
--- a/core/fpdfapi/fpdf_parser/cpdf_parser.cpp |
+++ b/core/fpdfapi/fpdf_parser/cpdf_parser.cpp |
@@ -1077,8 +1077,13 @@ |
FX_SAFE_UINT32 dwMaxObjNum = startnum; |
dwMaxObjNum += count; |
uint32_t dwV5Size = m_ObjectInfo.empty() ? 0 : GetLastObjNum() + 1; |
- if (!dwMaxObjNum.IsValid() || dwMaxObjNum.ValueOrDie() > dwV5Size) |
+ if (!dwMaxObjNum.IsValid()) |
continue; |
+ // When the max object number is larger than the defined size, try to |
+ // increase the size to accomodate more objects. |
+ // Some software messes this up, see chromium:596947. |
+ if (dwMaxObjNum.ValueOrDie() > dwV5Size) |
+ ShrinkObjectMap(dwMaxObjNum.ValueOrDie()); |
for (uint32_t j = 0; j < count; j++) { |
int32_t type = 1; |