[Poppler-bugs] [Bug 30590] New: poppler: OBJECT_TYPE_CHECK abort when reading /Matrix

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=30590

           Summary: poppler: OBJECT_TYPE_CHECK abort when reading /Matrix
           Product: poppler
           Version: unspecified
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: general
        AssignedTo: poppler-bugs at lists.freedesktop.org
        ReportedBy: thoger at redhat.com


I presume the crash mentioned in 2fe825deac commit message is OBJECT_TYPE_CHECK
abort when /BBox array contains non-numeric value.  Close to the /BBox reading
code, there's also /Matrix array reading code affected by the similar problem:

http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Gfx.cc?id=aa0fd32a#n4261

Additionally, there's one additional instance of BBox/Matrix reading code in
Gfx::doSoftMask that's likely to be affected by the same issue and have not
been changed in 2fe825deac:

http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Gfx.cc?id=aa0fd32a#n1245

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.