dany/pdfio
1
0
Fork 0
mirror of https://github.com/michaelrsweet/pdfio.git synced 2024-11-08 14:38:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix trailer dictionary handling (Issue #58)

Browse Source 
Fix generation number handling for object 0 (Issue #59)
This commit is contained in:
Michael R Sweet 2023-12-11 19:56:00 -05:00
parent 7084105dc4
commit 038fd8686b
No known key found for this signature in database
GPG Key ID: BE67C75EC81F3244
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES.md
View File

@ -15,6 +15,10 @@ v1.2.0 (Month DD, YYYY)
- Updated the token reading code to protect against some obvious abuses of the
PDF format.
- Updated the xref reading code to protect against loops.
- Fixed handling of of trailer dictionaries that started immediately after the
"trailer" keyword (Issue #58)
- Fixed handling of invalid, but common, PDF files with a generation number of
65536 in the xref table (Issue #59)
v1.1.4 (December 3, 2023)

15
pdfio-file.c
View File

@ -1736,7 +1736,7 @@ load_xref(
return (false);
}
if ((generation = (int)strtol(ptr, &ptr, 10)) < 0 || generation > 65535)
if ((generation = (int)strtol(ptr, &ptr, 10)) < 0 || (generation > 65535 && number != 0))
{
_pdfioFileError(pdf, "Bad xref table header '%s'.", line);
return (false);
@ -1979,9 +1979,20 @@ load_xref(
while (_pdfioFileGets(pdf, line, sizeof(line)))
{
if (!strncmp(line, "trailer", 7) && (!line[7] || isspace(line[7] & 255)))
{
if (line[7])
{
// Probably the start of the trailer dictionary, rewind the file so
// we can read it...
_pdfioFileSeek(pdf, 7 - strlen(line), SEEK_CUR);
}
break;
}
else if (!line[0])
{
continue;
}
if (sscanf(line, "%jd%jd", &number, &num_objects) != 2)
{
@ -2012,7 +2023,7 @@ load_xref(
return (false);
}
if ((generation = (int)strtol(ptr, &ptr, 10)) < 0 || generation > 65535)
if ((generation = (int)strtol(ptr, &ptr, 10)) < 0 || (generation > 65535 && offset != 0))
{
_pdfioFileError(pdf, "Malformed xref table entry '%s'.", line);
return (false);