blob: ac78d32ffa3a9778a4813c47d4cba388a8a9f61f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
Fixes CVE-2015-8868 (heap overflow).
Upstream source:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=b3425dd3261679958cd56c0f71995c15d2124433
From b3425dd3261679958cd56c0f71995c15d2124433 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Tue, 22 Dec 2015 22:50:33 +0100
Subject: Do not crash on invalid files
Bug #93476
diff --git a/poppler/Function.cc b/poppler/Function.cc
index 67283df..ee5afc1 100644
--- a/poppler/Function.cc
+++ b/poppler/Function.cc
@@ -577,6 +577,10 @@ ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
goto err2;
}
n = obj1.arrayGetLength();
+ if (unlikely(n > funcMaxOutputs)) {
+ error(errSyntaxError, -1, "Function's C0 array is wrong length");
+ n = funcMaxOutputs;
+ }
for (i = 0; i < n; ++i) {
obj1.arrayGet(i, &obj2);
if (!obj2.isNum()) {
--
cgit v0.10.2
|
