23 lines
750 B
Text
23 lines
750 B
Text
|
Security fix for CVE-2022-38171.
|
||
|
|
Extracted from upstream 4.04
|
||
|
|
|
||
|
|
Index: xpdf/JBIG2Stream.cc
|
||
|
|
--- xpdf/JBIG2Stream.cc.orig
|
||
|
|
+++ xpdf/JBIG2Stream.cc
|
||
|
|
@@ -1977,7 +1977,14 @@ void JBIG2Stream::readTextRegionSeg(Guint segNum, GBoo
|
||
|
|
for (i = 0; i < nRefSegs; ++i) {
|
||
|
|
if ((seg = findSegment(refSegs[i]))) {
|
||
|
|
if (seg->getType() == jbig2SegSymbolDict) {
|
||
|
|
- numSyms += ((JBIG2SymbolDict *)seg)->getSize();
|
||
|
|
+ Guint segSize = ((JBIG2SymbolDict *)seg)->getSize();
|
||
|
|
+ if (segSize > INT_MAX || numSyms > INT_MAX - segSize) {
|
||
|
|
+ error(errSyntaxError, getPos(),
|
||
|
|
+ "Too many symbols in JBIG2 text region");
|
||
|
|
+ delete codeTables;
|
||
|
|
+ return;
|
||
|
|
+ }
|
||
|
|
+ numSyms += segSize;
|
||
|
|
} else if (seg->getType() == jbig2SegCodeTable) {
|
||
|
|
codeTables->append(seg);
|
||
|
|
}
|