summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOliver Sander <oliver.sander@tu-dresden.de>2021-07-01 21:35:38 +0200
committerOliver Sander <oliver.sander@tu-dresden.de>2021-07-01 21:35:38 +0200
commit2b2808719d2c91283ae358381391bb0b37d9061d (patch)
treeaa09c6db1599329ad646519d128658eeac84152f
parent571d8138cb9ccc9ac04219a6a552d8c78e93ad88 (diff)
JBIG2Stream: Do not abort if size-0 allocations returns nullptr
The JBIG2SymbolDict constructor gets a size parameter, and it allocates memory for a bitmap of that size. Bug report 535 https://gitlab.freedesktop.org/poppler/poppler/-/issues/535 has a file where this size is 0. In that case, the call to gmallocn_checkoverflow returns nullptr, and subsequent calls to JBIG2SymbolDict::isOk return false. This is then interpreted as an error, and the JBIG2 processing is aborted. For the test file mentioned above this happens in line 1807. I don't know whether such a file with a size-0 symbol dict is malformed or not. However, the test file renders just fine if the 'failing' allocation is simply ignored. This patch therefore relaxes the isOk method a little. A JBIG2SymbolDict object is now deemed 'ok' either if it holds a bitmap (that was the previous test) *or if it has size 0*. This fixes https://gitlab.freedesktop.org/poppler/poppler/-/issues/535
-rw-r--r--poppler/JBIG2Stream.cc3
1 files changed, 2 insertions, 1 deletions
diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index 937f35ed..6ee19847 100644
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -967,7 +967,7 @@ public:
unsigned int getSize() { return size; }
void setBitmap(unsigned int idx, JBIG2Bitmap *bitmap) { bitmaps[idx] = bitmap; }
JBIG2Bitmap *getBitmap(unsigned int idx) { return bitmaps[idx]; }
- bool isOk() { return bitmaps != nullptr; }
+ bool isOk() { return bitmaps != nullptr || size == 0; }
void setGenericRegionStats(JArithmeticDecoderStats *stats) { genericRegionStats = stats; }
void setRefinementRegionStats(JArithmeticDecoderStats *stats) { refinementRegionStats = stats; }
JArithmeticDecoderStats *getGenericRegionStats() { return genericRegionStats; }
@@ -1329,6 +1329,7 @@ void JBIG2Stream::readSegments()
switch (segType) {
case 0:
if (!readSymbolDictSeg(segNum, segLength, refSegs, nRefSegs)) {
+ error(errSyntaxError, curStr->getPos(), "readSymbolDictSeg reports syntax error!");
goto syntaxError;
}
break;