diff options
| author | Albert Astals Cid <aacid@kde.org> | 2012-04-29 22:33:09 +0200 |
|---|---|---|
| committer | Albert Astals Cid <aacid@kde.org> | 2012-04-29 22:33:37 +0200 |
| commit | 50c0b294d08114920a5db711876e20d991f474a6 (patch) | |
| tree | 733e65229f6e7198d29a2d5c6e1886ce7826e051 | |
| parent | 9e36206465289c96cb189c648a6f5121714c647b (diff) | |
Make sure the index to dcHuffTables and acHuffTables is in bounds
Found in a fuzzed pdf sent by Mateusz "j00ru" Jurczyk and Gynvael Coldwind
| -rw-r--r-- | poppler/Stream.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/poppler/Stream.cc b/poppler/Stream.cc index 423bf1c9..4ce6c006 100644 --- a/poppler/Stream.cc +++ b/poppler/Stream.cc @@ -2581,6 +2581,9 @@ GBool DCTStream::readMCURow() { vSub = vert / 8; for (y2 = 0; y2 < mcuHeight; y2 += vert) { for (x2 = 0; x2 < mcuWidth; x2 += horiz) { + if (unlikely(scanInfo.dcHuffTable[cc] >= 4) || unlikely(scanInfo.acHuffTable[cc] >= 4)) { + return gFalse; + } if (!readDataUnit(&dcHuffTables[scanInfo.dcHuffTable[cc]], &acHuffTables[scanInfo.acHuffTable[cc]], &compInfo[cc].prevDC, |