[poppler] poppler/Linearization.cc

[Albert Astals Cid]

 poppler/Linearization.cc |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 545a8f7cb0a473706858d2851f968ffadcc78ed0
Author: Jason Crain <jason at aquaticape.us>
Date:   Mon Aug 24 01:12:01 2015 +0200

    Fix bounds check in Linearization::getPageFirst
    
    Make sure Linearization::pageFirst is in the interval [0, getNumPages),
    otherwise Hints::getPageObjectNum() can have an out of bounds read.
    
    Bug #91200

diff --git a/poppler/Linearization.cc b/poppler/Linearization.cc
index 33331d1..be041f9 100644
--- a/poppler/Linearization.cc
+++ b/poppler/Linearization.cc
@@ -5,6 +5,7 @@
 // This file is licensed under the GPLv2 or later
 //
 // Copyright 2010, 2012 Hib Eris <hib at hiberis.nl>
+// Copyright 2015 Jason Crain <jason at aquaticape.us>
 //
 //========================================================================
 
@@ -211,7 +212,7 @@ int Linearization::getPageFirst()
     linDict.getDict()->lookupInt("P", NULL, &pageFirst);
   }
 
-  if ((pageFirst < 0) || (pageFirst > getNumPages())) {
+  if ((pageFirst < 0) || (pageFirst >= getNumPages())) {
     error(errSyntaxWarning, -1, "First page in linearization table is invalid");
     return 0;
   }