<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - invalid input will cause out of bounds heap read in function Hints::getPageObjectNum"
href="https://bugs.freedesktop.org/show_bug.cgi?id=91200#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - invalid input will cause out of bounds heap read in function Hints::getPageObjectNum"
href="https://bugs.freedesktop.org/show_bug.cgi?id=91200">bug 91200</a>
from <span class="vcard"><a class="email" href="mailto:jason@aquaticape.us" title="Jason Crain <jason@aquaticape.us>"> <span class="fn">Jason Crain</span></a>
</span></b>
<pre>Created <span class=""><a href="attachment.cgi?id=117884" name="attach_117884" title="Fix bounds check in Linearization::getPageFirst">attachment 117884</a> <a href="attachment.cgi?id=117884&action=edit" title="Fix bounds check in Linearization::getPageFirst">[details]</a></span> <a href='page.cgi?id=splinter.html&bug=91200&attachment=117884'>[review]</a>
Fix bounds check in Linearization::getPageFirst
This document has a linearization parameter dictionary in which the 'first
page' parameter, /P, is equal to the total number of pages /N and is therefore
out of bounds, and leads to Hints::getPageObjectNum having an out of bounds
read. The attached patch modified a bounds check to make sure pageFirst is
within the interval [0, getNumPages).</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>