forked from pool/mupdf
1369417c55
CVE-2017-7976.patch to fix CVE-2016-10221, CVE-2016-8728, CVE-2016-8729 and CVE-2017-7976 bsc#1032140 bsc#1039850 bsc#1052029 OBS-URL: https://build.opensuse.org/package/show/Publishing/mupdf?expand=0&rev=56
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
X-Git-Url: http://git.ghostscript.com/?p=mupdf.git;a=blobdiff_plain;f=source%2Fpdf%2Fpdf-layer.c;h=fc29c9d3e78eefa823cf768a9a37c476ba6f7c20;hp=3296b6c5ad953a1050899ae01021be05b3b08fa3;hb=2590fed7a355a421f062ebd4293df892800fa7ac;hpb=ffc4b61e6baf7a4d4e34c8901ae78ffd57da2530
|
|
|
|
diff --git a/source/pdf/pdf-layer.c b/source/pdf/pdf-layer.c
|
|
index 3296b6c..fc29c9d 100644
|
|
--- a/source/pdf/pdf-layer.c
|
|
+++ b/source/pdf/pdf-layer.c
|
|
@@ -90,7 +90,14 @@ count_entries(fz_context *ctx, pdf_obj *obj)
|
|
for (i = 0; i < len; i++)
|
|
{
|
|
pdf_obj *o = pdf_array_get(ctx, obj, i);
|
|
- count += (pdf_is_array(ctx, o) ? count_entries(ctx, o) : 1);
|
|
+ if (pdf_mark_obj(ctx, o))
|
|
+ continue;
|
|
+ fz_try(ctx)
|
|
+ count += (pdf_is_array(ctx, o) ? count_entries(ctx, o) : 1);
|
|
+ fz_always(ctx)
|
|
+ pdf_unmark_obj(ctx, o);
|
|
+ fz_catch(ctx)
|
|
+ fz_rethrow(ctx);
|
|
}
|
|
return count;
|
|
}
|
|
@@ -106,7 +113,16 @@ populate_ui(fz_context *ctx, pdf_ocg_descriptor *desc, pdf_ocg_ui *ui, pdf_obj *
|
|
pdf_obj *o = pdf_array_get(ctx, order, i);
|
|
if (pdf_is_array(ctx, o))
|
|
{
|
|
- ui = populate_ui(ctx, desc, ui, o, depth+1, rbgroups, locked);
|
|
+ if (pdf_mark_obj(ctx, o))
|
|
+ continue;
|
|
+
|
|
+ fz_try(ctx)
|
|
+ ui = populate_ui(ctx, desc, ui, o, depth+1, rbgroups, locked);
|
|
+ fz_always(ctx)
|
|
+ pdf_unmark_obj(ctx, o);
|
|
+ fz_catch(ctx)
|
|
+ fz_rethrow(ctx);
|
|
+
|
|
continue;
|
|
}
|
|
ui->depth = depth;
|