Fix crash in 1255.pdf.SIGSEGV.56f.285

1 files changed, 6 insertions, 0 deletions

diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 35648073..9a0c9006 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -719,6 +719,10 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
       error(errSyntaxError, -1, "Invalid 'size' inside xref table");
       return gFalse;
     }
+    if (first + n > size) {
+      error(errSyntaxError, -1, "Invalid 'first' or 'n' inside xref table");
+      return gFalse;
+    }
   }
   for (i = first; i < first + n; ++i) {
     if (w[0] == 0) {
@@ -1085,6 +1089,8 @@ Object *XRef::fetch(int num, int gen, Object *obj, int recursion) {
 	objStr = NULL;
 	goto err;
       } else {
+	// XRef could be reconstructed in constructor of ObjectStream:
+	e = getEntry(num);
 	ObjectStreamKey *newkey = new ObjectStreamKey(e->offset);
 	ObjectStreamItem *newitem = new ObjectStreamItem(objStr);
 	objStrs->put(newkey, newitem);