Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1427)

Unified Diff: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Issue 501823003: Perform better input checks in early steps of parser. (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Fix || => && typo. Created 6 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index e0fd3bfaeecea13e1b023d68982f3d35897ff2b9..a597ea0a081247db3e0b5f48b280d79c31b96760 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -51,6 +51,7 @@ CPDF_Parser::CPDF_Parser()
m_dwFirstPageNo = 0;
m_dwXrefStartObjNum = 0;
m_bOwnFileRead = TRUE;
+ m_FileVersion = 0;
m_bForceUseSecurityHandler = FALSE;
}
CPDF_Parser::~CPDF_Parser()
@@ -158,10 +159,21 @@ FX_DWORD CPDF_Parser::StartParse(IFX_FileRead* pFileAccess, FX_BOOL bReParse, FX
}
m_Syntax.InitParser(pFileAccess, offset);
FX_BYTE ch;
- m_Syntax.GetCharAt(5, ch);
- m_FileVersion = (ch - '0') * 10;
- m_Syntax.GetCharAt(7, ch);
- m_FileVersion += ch - '0';
+ if (!m_Syntax.GetCharAt(5, ch)) {
+ return PDFPARSE_ERROR_FORMAT;
+ }
+ if (ch >= '0' && ch <= '9') {
+ m_FileVersion = (ch - '0') * 10;
+ }
+ if (!m_Syntax.GetCharAt(7, ch)) {
+ return PDFPARSE_ERROR_FORMAT;
+ }
+ if (ch >= '0' && ch <= '9') {
+ m_FileVersion += ch - '0';
+ }
+ if (m_Syntax.m_FileLen < m_Syntax.m_HeaderOffset + 9) {
+ return PDFPARSE_ERROR_FORMAT;
+ }
m_Syntax.RestorePos(m_Syntax.m_FileLen - m_Syntax.m_HeaderOffset - 9);
if (!bReParse) {
m_pDocument = FX_NEW CPDF_Document(this);
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698