1From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001
2From: Robin Watts <Robin.Watts@artifex.com>
3Date: Fri, 22 Jan 2021 17:05:15 +0000
4Subject: [PATCH] Bug 703366: Fix double free of object during linearization.
5
6This appears to happen because we parse an illegal object from
7a broken file and assign it to object 0, which is defined to
8be free.
9
10Here, we fix the parsing code so this can't happen.
11
12[Retrieved from:
13http://git.ghostscript.com/?p=mupdf.git;h=cee7cefc610d42fd383b3c80c12cbc675443176a]
14Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
15---
16 source/pdf/pdf-parse.c | 6 ++++++
17 source/pdf/pdf-xref.c  | 2 ++
18 2 files changed, 8 insertions(+)
19
20diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
21index 7abc8c3d4..5761c3351 100644
22--- a/source/pdf/pdf-parse.c
23+++ b/source/pdf/pdf-parse.c
24@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
25 		fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
26 	}
27 	gen = buf->i;
28+	if (gen < 0 || gen >= 65536)
29+	{
30+		if (try_repair)
31+			*try_repair = 1;
32+		fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
33+	}
34
35 	tok = pdf_lex(ctx, file, buf);
36 	if (tok != PDF_TOK_OBJ)
37diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
38index 1b2bdcd59..30197b4b8 100644
39--- a/source/pdf/pdf-xref.c
40+++ b/source/pdf/pdf-xref.c
41@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
42 	{
43 		ofs = fz_tell(ctx, doc->file);
44 		trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
45+		if (num == 0)
46+			fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
47 	}
48 	fz_catch(ctx)
49 	{
50--
512.17.1
52
53