1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
|
From: Robin Watts <robin.watts@artifex.com>
Date: Thu, 21 Jul 2016 15:39:11 +0100
Subject: Bug 696941: Fix use after free.
The file is HORRIBLY corrupt, and triggers Sophos to think it's
PDF malware (which it isn't). It does however trigger a use
after free, worked around here.
---
source/pdf/pdf-xref.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index b3505c3..c01bc61 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -835,8 +835,14 @@ pdf_load_xref(pdf_document *doc, pdf_lexbuf *buf)
fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", entry->ofs, i);
}
if (entry->type == 'o')
- if (entry->ofs <= 0 || entry->ofs >= xref_len || pdf_get_xref_entry(doc, entry->ofs)->type != 'n')
- fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", entry->ofs, i);
+ {
+ /* Read this into a local variable here, because pdf_get_xref_entry
+ * may solidify the xref, hence invalidating "entry", meaning we
+ * need a stashed value for the throw. */
+ int64_t ofs = entry->ofs;
+ if (ofs <= 0 || ofs >= xref_len || pdf_get_xref_entry(doc, ofs)->type != 'n')
+ fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
+ }
}
}
|