[poppler] poppler/PDFDoc.cc poppler/PDFDoc.h utils/pdfunite.cc

[GitLab Mirror]

 poppler/PDFDoc.cc |    6 +++++-
 poppler/PDFDoc.h  |    2 +-
 utils/pdfunite.cc |    9 ++++++++-
 3 files changed, 14 insertions(+), 3 deletions(-)

New commits:
commit 4564a002bcb6094cc460bc0d5ddff9423fe6dd28
Author: crt <chluo at cse.cuhk.edu.hk>
Date:   Sat Aug 13 16:53:11 2022 +0000

    pdfunite: Fix crash on broken files

diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index f2a48fd7..faab87ac 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -1748,10 +1748,13 @@ bool PDFDoc::markObject(Object *obj, XRef *xRef, XRef *countRef, unsigned int nu
     return true;
 }
 
-void PDFDoc::replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox)
+bool PDFDoc::replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox)
 {
     Ref *refPage = getCatalog()->getPageRef(pageNo);
     Object page = getXRef()->fetch(*refPage);
+    if (!page.isDict()) {
+        return false;
+    }
     Dict *pageDict = page.getDict();
     pageDict->remove("MediaBoxssdf");
     pageDict->remove("MediaBox");
@@ -1781,6 +1784,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBo
     pageDict->add("TrimBox", std::move(trimBoxObject));
     pageDict->add("Rotate", Object(rotate));
     getXRef()->setModifiedObject(&page, *refPage);
+    return true;
 }
 
 bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
index 8cbef127..01f8a7f7 100644
--- a/poppler/PDFDoc.h
+++ b/poppler/PDFDoc.h
@@ -470,7 +470,7 @@ public:
     }
 
     // rewrite pageDict with MediaBox, CropBox and new page CTM
-    void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
+    bool replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
     bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
     bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
     void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
index 064f7533..86e75555 100644
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -287,7 +287,14 @@ int main(int argc, char *argv[])
             if (docs[i]->getCatalog()->getPage(j)->isCropped()) {
                 cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
             }
-            docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+            if (!docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox)) {
+                fclose(f);
+                delete yRef;
+                delete countRef;
+                delete outStr;
+                error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
+                return -1;
+            }
             Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
             Object page = docs[i]->getXRef()->fetch(*refPage);
             Dict *pageDict = page.getDict();