[poppler] poppler/Form.cc

[GitLab Mirror]

 poppler/Form.cc |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit a4ca3a96a6b1f65b335a1ea362e6c202e46ae055
Author: Albert Astals Cid <aacid at kde.org>
Date:   Wed Oct 19 15:51:43 2022 +0200

    topIdx can't be negative
    
    Fixes crash on broken files. Issue #1303

diff --git a/poppler/Form.cc b/poppler/Form.cc
index 4dfba6dd..d33160b3 100644
--- a/poppler/Form.cc
+++ b/poppler/Form.cc
@@ -1845,6 +1845,10 @@ FormFieldChoice::FormFieldChoice(PDFDoc *docA, Object &&aobj, const Ref refA, Fo
     obj1 = dict->lookup("TI");
     if (obj1.isInt()) {
         topIdx = obj1.getInt();
+        if (topIdx < 0) {
+            error(errSyntaxError, -1, "FormFieldChoice:: invalid topIdx entry\n");
+            topIdx = 0;
+        }
     }
 
     obj1 = Form::fieldLookup(dict, "Opt");