diff options
| -rw-r--r-- | poppler/XRef.cc | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/poppler/XRef.cc b/poppler/XRef.cc index 0e99a3f6..832a0384 100644 --- a/poppler/XRef.cc +++ b/poppler/XRef.cc @@ -129,7 +129,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { goto err1; } - if (nObjects*(int)sizeof(int)/sizeof(int) != nObjects) { + if (nObjects >= INT_MAX / (int)sizeof(int)) { error(-1, "Invalid 'nObjects'"); goto err1; } @@ -421,7 +421,7 @@ GBool XRef::readXRefTable(Parser *parser, Guint *pos) { if (newSize < 0) { goto err1; } - if (newSize*(int)sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) { + if (newSize >= INT_MAX / (int)sizeof(XRefEntry)) { error(-1, "Invalid 'obj' parameters'"); goto err1; } @@ -537,7 +537,7 @@ GBool XRef::readXRefStream(Stream *xrefStr, Guint *pos) { goto err1; } if (newSize > size) { - if (newSize * (int)sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) { + if (newSize >= INT_MAX / (int)sizeof(XRefEntry)) { error(-1, "Invalid 'size' parameter."); return gFalse; } @@ -634,7 +634,7 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) { if (newSize < 0) { return gFalse; } - if (newSize*(int)sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) { + if (newSize >= INT_MAX / (int)sizeof(XRefEntry)) { error(-1, "Invalid 'size' inside xref table."); return gFalse; } @@ -780,7 +780,7 @@ GBool XRef::constructXRef() { error(-1, "Bad object number"); return gFalse; } - if (newSize*(int)sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) { + if (newSize >= INT_MAX / (int)sizeof(XRefEntry)) { error(-1, "Invalid 'obj' parameters."); return gFalse; } @@ -809,7 +809,7 @@ GBool XRef::constructXRef() { } else if (!strncmp(p, "endstream", 9)) { if (streamEndsLen == streamEndsSize) { streamEndsSize += 64; - if (streamEndsSize*(int)sizeof(int)/sizeof(int) != streamEndsSize) { + if (streamEndsSize >= INT_MAX / (int)sizeof(int)) { error(-1, "Invalid 'endstream' parameter."); return gFalse; } |