[poppler] poppler/JBIG2Stream.cc

[GitLab Mirror]

 poppler/JBIG2Stream.cc |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 2b2808719d2c91283ae358381391bb0b37d9061d
Author: Oliver Sander <oliver.sander at tu-dresden.de>
Date:   Thu Jul 1 21:35:38 2021 +0200

    JBIG2Stream: Do not abort if size-0 allocations returns nullptr
    
    The JBIG2SymbolDict constructor gets a size parameter, and it allocates
    memory for a bitmap of that size.  Bug report 535
    
      https://gitlab.freedesktop.org/poppler/poppler/-/issues/535
    
    has a file where this size is 0.  In that case, the call to
    gmallocn_checkoverflow returns nullptr, and subsequent calls to
    JBIG2SymbolDict::isOk return false.  This is then interpreted
    as an error, and the JBIG2 processing is aborted.  For the
    test file mentioned above this happens in line 1807.
    
    I don't know whether such a file with a size-0 symbol dict
    is malformed or not.  However, the test file renders just fine
    if the 'failing' allocation is simply ignored.  This patch
    therefore relaxes the isOk method a little.  A JBIG2SymbolDict
    object is now deemed 'ok' either if it holds a bitmap (that was
    the previous test) *or if it has size 0*.
    
    This fixes
    
      https://gitlab.freedesktop.org/poppler/poppler/-/issues/535

diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index 937f35ed..6ee19847 100644
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -967,7 +967,7 @@ public:
     unsigned int getSize() { return size; }
     void setBitmap(unsigned int idx, JBIG2Bitmap *bitmap) { bitmaps[idx] = bitmap; }
     JBIG2Bitmap *getBitmap(unsigned int idx) { return bitmaps[idx]; }
-    bool isOk() { return bitmaps != nullptr; }
+    bool isOk() { return bitmaps != nullptr || size == 0; }
     void setGenericRegionStats(JArithmeticDecoderStats *stats) { genericRegionStats = stats; }
     void setRefinementRegionStats(JArithmeticDecoderStats *stats) { refinementRegionStats = stats; }
     JArithmeticDecoderStats *getGenericRegionStats() { return genericRegionStats; }
@@ -1329,6 +1329,7 @@ void JBIG2Stream::readSegments()
         switch (segType) {
         case 0:
             if (!readSymbolDictSeg(segNum, segLength, refSegs, nRefSegs)) {
+                error(errSyntaxError, curStr->getPos(), "readSymbolDictSeg reports syntax error!");
                 goto syntaxError;
             }
             break;