Do not crash on invalid files

Bug #93476

1 files changed, 4 insertions, 0 deletions

diff --git a/poppler/Function.cc b/poppler/Function.cc
index 67283dff..ee5afc14 100644
--- a/poppler/Function.cc
+++ b/poppler/Function.cc
@@ -577,6 +577,10 @@ ExponentialFunction::ExponentialFunction(Object *funcObj, Dict *dict) {
       goto err2;
     }
     n = obj1.arrayGetLength();
+    if (unlikely(n > funcMaxOutputs)) {
+      error(errSyntaxError, -1, "Function's C0 array is wrong length");
+      n = funcMaxOutputs;
+    }
     for (i = 0; i < n; ++i) {
       obj1.arrayGet(i, &obj2);
       if (!obj2.isNum()) {