~mcf/mupdf

cee7cefc610d42fd383b3c80c12cbc675443176a — Robin Watts 10 months ago fb9eb33
Bug 703366: Fix double free of object during linearization.

This appears to happen because we parse an illegal object from
a broken file and assign it to object 0, which is defined to
be free.

Here, we fix the parsing code so this can't happen.
2 files changed, 8 insertions(+), 0 deletions(-)

M source/pdf/pdf-parse.c
M source/pdf/pdf-xref.c
M source/pdf/pdf-parse.c => source/pdf/pdf-parse.c +6 -0
@@ 749,6 749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
		fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
	}
	gen = buf->i;
	if (gen < 0 || gen >= 65536)
	{
		if (try_repair)
			*try_repair = 1;
		fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
	}

	tok = pdf_lex(ctx, file, buf);
	if (tok != PDF_TOK_OBJ)

M source/pdf/pdf-xref.c => source/pdf/pdf-xref.c +2 -0
@@ 1190,6 1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
	{
		ofs = fz_tell(ctx, doc->file);
		trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
		if (num == 0)
			fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
	}
	fz_catch(ctx)
	{