[Poppler-bugs] [Bug 16633] The patch for a crash when "IRT" object is present

[bugzilla-daemon at freedesktop.org]

http://bugs.freedesktop.org/show_bug.cgi?id=16633





--- Comment #2 from tlknv <tlknv at yandex.ru>  2008-07-20 11:36:42 PST ---
Sorry. I can't attach that pdf. It's a private data. If you have any pdf that
causes execution of the line
     inReplyTo = obj1.getDict();
then you get a crash with pdftohtml for sure.
Anyway the logic is simple. Without inReplyTo->incRef() the nearest
obj1.free() destroys/frees the object pointed by inReplyTo. So inReplyTo points
to freed memory. Just in case, I compiled it under MSVC 2005.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.