[poppler] poppler/Outline.cc

[Albert Astals Cid]

 poppler/Outline.cc |   15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

New commits:
commit 4dfa7460ddc4b5684d5ef8db17efa50b95b7b735
Author: Nick Jones <nick.jones at network-box.com>
Date:   Tue Mar 3 00:55:53 2009 +0100

    Do not blindly follow loops parsing OutlineItem
    
    More details in bug 18364

diff --git a/poppler/Outline.cc b/poppler/Outline.cc
index 8a2a791..bd4e6d0 100644
--- a/poppler/Outline.cc
+++ b/poppler/Outline.cc
@@ -15,6 +15,7 @@
 //
 // Copyright (C) 2005 Marco Pesenti Gritti <mpg at redhat.com>
 // Copyright (C) 2008 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2009 Nick Jones <nick.jones at network-box.com>
 //
 // To see a description of the changes please see the Changelog file that
 // came with your tarball or type make ChangeLog if you are building from git
@@ -30,6 +31,7 @@
 #include "goo/gmem.h"
 #include "goo/GooString.h"
 #include "goo/GooList.h"
+#include "XRef.h"
 #include "Link.h"
 #include "PDFDocEncoding.h"
 #include "Outline.h"
@@ -129,6 +131,7 @@ OutlineItem::~OutlineItem() {
 GooList *OutlineItem::readItemList(Object *firstItemRef, Object *lastItemRef,
 				 XRef *xrefA) {
   GooList *items;
+  char* alreadyRead;
   OutlineItem *item;
   Object obj;
   Object *p;
@@ -137,12 +140,20 @@ GooList *OutlineItem::readItemList(Object *firstItemRef, Object *lastItemRef,
     return NULL;
 
   items = new GooList();
+
+  alreadyRead = (char *)gmalloc(xrefA->getNumObjects());
+  memset(alreadyRead, 0, xrefA->getNumObjects());
+
   p = firstItemRef;
-  while (p->isRef()) {
+  while (p->isRef() && 
+	 (p->getRefNum() >= 0) && 
+         (p->getRefNum() < xrefA->getNumObjects()) && 
+         !alreadyRead[p->getRefNum()]) {
     if (!p->fetch(xrefA, &obj)->isDict()) {
       obj.free();
       break;
     }
+    alreadyRead[p->getRefNum()] = 1;
     item = new OutlineItem(obj.getDict(), xrefA);
     obj.free();
     items->append(item);
@@ -153,6 +164,8 @@ GooList *OutlineItem::readItemList(Object *firstItemRef, Object *lastItemRef,
     p = &item->nextRef;
   }
 
+  gfree(alreadyRead);
+
   if (!items->getLength()) {
     delete items;
     items = NULL;