[poppler] 2 commits - poppler/XRef.cc utils/HtmlOutputDev.cc

[Albert Astals Cid]

 poppler/XRef.cc        |   11 +++++++++++
 utils/HtmlOutputDev.cc |   18 ++++++++++--------
 2 files changed, 21 insertions(+), 8 deletions(-)

New commits:
commit 2f1e7ef252b8d1f7ee6004825c2926f0f5e181a5
Author: Albert Astals Cid <aacid at kde.org>
Date:   Thu Apr 12 23:11:41 2012 +0200

    Do not crash in broken documents
    
    They might trigger an xref reconstruct and then i could not be in bounds anymore
    Crash found by Joel Voss of Leviathan Security Group

diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 60c2f9d..80ce17f 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -1358,6 +1358,17 @@ XRefEntry *XRef::getEntry(int i)
            break;
         }
       }
+      
+      // We might have reconstructed the xref
+      // Check again i is in bounds
+      if (unlikely(i >= size)) {
+        static XRefEntry dummy;
+        dummy.offset = 0;
+        dummy.gen = -1;
+        dummy.type = xrefEntryNone;
+        dummy.updated = false;
+        return &dummy;
+      }
 
       if (entries[i].type == xrefEntryNone) {
          error(errSyntaxError, -1, "Invalid XRef entry");
commit 19fb9caecb1b265a8b8651e9bcf4b779f593fefd
Author: Albert Astals Cid <aacid at kde.org>
Date:   Thu Apr 12 22:24:50 2012 +0200

    Fix crash when the destination file does not exist
    
    Issue found by Joel Voss of Leviathan Security Group

diff --git a/utils/HtmlOutputDev.cc b/utils/HtmlOutputDev.cc
index bd8c642..2f07988 100644
--- a/utils/HtmlOutputDev.cc
+++ b/utils/HtmlOutputDev.cc
@@ -1222,14 +1222,16 @@ HtmlOutputDev::~HtmlOutputDev() {
       fputs("</BODY>\n</HTML>\n",fContentsFrame);  
       fclose(fContentsFrame);
     }
-    if (xml) {
-      fputs("</pdf2xml>\n",page);  
-      fclose(page);
-    } else
-    if ( !complexMode || xml || noframes )
-    { 
-      fputs("</BODY>\n</HTML>\n",page);  
-      fclose(page);
+    if (page != NULL) {
+      if (xml) {
+        fputs("</pdf2xml>\n",page);  
+        fclose(page);
+      } else
+      if ( !complexMode || xml || noframes )
+      { 
+        fputs("</BODY>\n</HTML>\n",page);  
+        fclose(page);
+      }
     }
     if (pages)
       delete pages;