| Index: core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| index 63a64a302691f5b8ca63cdf1b1f674cd437d8c4a..7a3fbacfb3ae91b71b9ca87da99b2edcb44ecb69 100644
|
| --- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| +++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
|
| @@ -109,6 +109,12 @@ FX_BOOL CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
|
| // Item 13: Skip Item 13 which has 16 bits.
|
| hStream->SkipBits(16);
|
|
|
| + // The maximum number of bits allowed to represent the greatest number of
|
| + // shared object references. 2^39 should be more than enough.
|
| + constexpr uint32_t kMaxSharedObjBits = 39;
|
| + if (dwSharedObjBits > kMaxSharedObjBits)
|
| + return FALSE;
|
| +
|
| CPDF_Object* pPageNum = m_pLinearizedDict->GetDirectObjectBy("N");
|
| int nPages = pPageNum ? pPageNum->GetInteger() : 0;
|
| if (nPages < 1)
|
|
|