File CVE-2016-6265.patch of Package mupdf.openSUSE_Leap_42.1_Update

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-6265.patch of Package mupdf.openSUSE_Leap_42.1_Update

Index: mupdf-1.7a-source/source/pdf/pdf-xref.c
===================================================================
--- mupdf-1.7a-source.orig/source/pdf/pdf-xref.c
+++ mupdf-1.7a-source/source/pdf/pdf-xref.c
@@ -1087,8 +1087,14 @@ pdf_load_xref(fz_context *ctx, pdf_docum
 				fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", entry->ofs, i);
 		}
 		if (entry->type == 'o')
-			if (entry->ofs <= 0 || entry->ofs >= xref_len || pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
-				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", entry->ofs, i);
+        {
+			/* Read this into a local variable here, because pdf_get_xref_entry
+			 * may solidify the xref, hence invalidating "entry", meaning we
+			 * need a stashed value for the throw. */
+			int64_t ofs = entry->ofs;
+			if (ofs <= 0 || ofs >= xref_len || pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
+				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
+        }
 	}
 }

Places

File CVE-2016-6265.patch of Package mupdf.openSUSE_Leap_42.1_Update

Places