Attachment #23923 for bug #59963

View | Details | Raw Unified | Return to bug 59963
Collapse All | Expand All

Lines 76-81 Link Here

(-)XRef.cc.orig (+10 lines)
76		76
77	// trailer is ok - read the xref table	77	// trailer is ok - read the xref table
78	} else {	78	} else {
		79	if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
		80	error(-1, "Invalid 'size' inside xref table.");
		81	ok = gFalse;
		82	errCode = errDamaged;
		83	return;
		84	}
79	entries = (XRefEntry )gmalloc(size sizeof(XRefEntry));	85	entries = (XRefEntry )gmalloc(size sizeof(XRefEntry));
80	for (i = 0; i < size; ++i) {	86	for (i = 0; i < size; ++i) {
81	entries[i].offset = 0xffffffff;	87	entries[i].offset = 0xffffffff;
Lines 410-415 Link Here
410	if (!strncmp(p, "obj", 3)) {	416	if (!strncmp(p, "obj", 3)) {
411	if (num >= size) {	417	if (num >= size) {
412	newSize = (num + 1 + 255) & ~255;	418	newSize = (num + 1 + 255) & ~255;
		419	if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
		420	error(-1, "Invalid 'obj' parameters.");
		421	return gFalse;
		422	}
413	entries = (XRefEntry *)	423	entries = (XRefEntry *)
414	grealloc(entries, newSize * sizeof(XRefEntry));	424	grealloc(entries, newSize * sizeof(XRefEntry));
415	for (i = size; i < newSize; ++i) {	425	for (i = size; i < newSize; ++i) {

Lines 63-68 Link Here

(-)Catalog.cc.orig (+6 lines)
63	}	63	}
64	pagesSize = numPages0 = obj.getInt();	64	pagesSize = numPages0 = obj.getInt();
65	obj.free();	65	obj.free();
		66	if (pagesSizesizeof(Page )/sizeof(Page *) != pagesSize \|\|
		67	pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
		68	error(-1, "Invalid 'pagesSize'");
		69	ok = gFalse;
		70	return;
		71	}
66	pages = (Page *)gmalloc(pagesSize sizeof(Page *));	72	pages = (Page *)gmalloc(pagesSize sizeof(Page *));
67	pageRefs = (Ref )gmalloc(pagesSize sizeof(Ref));	73	pageRefs = (Ref )gmalloc(pagesSize sizeof(Ref));
68	for (i = 0; i < pagesSize; ++i) {	74	for (i = 0; i < pagesSize; ++i) {

Return to bug 59963