diff options
| author | Jay Berkenbilt <ejb@ql.org> | 2015-02-21 23:40:41 +0100 |
|---|---|---|
| committer | Jay Berkenbilt <ejb@ql.org> | 2015-02-21 23:51:08 +0100 |
| commit | c729e07d55c870e7e08f158f0a80a3d452c59cdc (patch) | |
| tree | 2130876f9bf7f6ec45cc6bcaec75c921976ab317 /libqpdf | |
| parent | d8900c2255d12adbe9342ea751403740ca7a826d (diff) | |
| download | qpdf-c729e07d55c870e7e08f158f0a80a3d452c59cdc.tar.zst | |
Avoid resolving arguments to R
When checking two objects preceding R while parsing, ensure that the
objects are direct. This avoids stuff like 1 0 obj containing 1 0 R 0 R
from causing an infinite loop in object resolution.
Diffstat (limited to 'libqpdf')
| -rw-r--r-- | libqpdf/QPDFObjectHandle.cc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libqpdf/QPDFObjectHandle.cc b/libqpdf/QPDFObjectHandle.cc index eec4fae3..64a4e3c3 100644 --- a/libqpdf/QPDFObjectHandle.cc +++ b/libqpdf/QPDFObjectHandle.cc @@ -966,7 +966,9 @@ QPDFObjectHandle::parseInternal(PointerHolder<InputSource> input, std::string const& value = token.getValue(); if ((value == "R") && (in_array || in_dictionary) && (olist.size() >= 2) && + (! olist.at(olist.size() - 1).isIndirect()) && (olist.at(olist.size() - 1).isInteger()) && + (! olist.at(olist.size() - 2).isIndirect()) && (olist.at(olist.size() - 2).isInteger())) { if (context == 0) |