Index: core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp |
diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp |
index 63a64a302691f5b8ca63cdf1b1f674cd437d8c4a..7a3fbacfb3ae91b71b9ca87da99b2edcb44ecb69 100644 |
--- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp |
+++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp |
@@ -109,6 +109,12 @@ FX_BOOL CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) { |
// Item 13: Skip Item 13 which has 16 bits. |
hStream->SkipBits(16); |
+ // The maximum number of bits allowed to represent the greatest number of |
+ // shared object references. 2^39 should be more than enough. |
+ constexpr uint32_t kMaxSharedObjBits = 39; |
+ if (dwSharedObjBits > kMaxSharedObjBits) |
+ return FALSE; |
+ |
CPDF_Object* pPageNum = m_pLinearizedDict->GetDirectObjectBy("N"); |
int nPages = pPageNum ? pPageNum->GetInteger() : 0; |
if (nPages < 1) |