Marmelator/pdf.js.mirror
1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2026-06-27 18:45:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix infinite loop in JBIG2 decoder with >4 referred-to segments and add regression test

Browse Source
This commit is contained in:
Gaurang Bhatia 2025-12-07 06:46:16 +05:30
parent e7288dca8e
commit ac8d80a8e4
4 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/core/jbig2.js
View File

@ -1165,15 +1165,15 @@ function readSegmentHeader(data, start) {
let referredToCount = (referredFlags >> 5) & 7; let referredToCount = (referredFlags >> 5) & 7;
const retainBits = [referredFlags & 31]; const retainBits = [referredFlags & 31];
let position = start + 6; let position = start + 6;
if (referredFlags === 7) { if (referredToCount === 7) {
referredToCount = readUint32(data, position - 1) & 0x1fffffff; referredToCount = readUint32(data, position - 1) & 0x1fffffff;
position += 3; position += 3;
let bytes = (referredToCount + 7) >> 3; let bytes = (referredToCount + 8) >> 3;
retainBits[0] = data[position++]; retainBits[0] = data[position++];
while (--bytes > 0) { while (--bytes > 0) {
retainBits.push(data[position++]); retainBits.push(data[position++]);
} }
} else if (referredFlags === 5 || referredFlags === 6) { } else if (referredToCount === 5 || referredToCount === 6) {
throw new Jbig2Error("invalid referred-to flags"); throw new Jbig2Error("invalid referred-to flags");
} }

1
test/pdfs/.gitignore vendored
View File

@ -749,6 +749,7 @@
!comments.pdf !comments.pdf
!issue20319_1.pdf !issue20319_1.pdf
!issue20319_2.pdf !issue20319_2.pdf
!issue20439.pdf
!bug1992868.pdf !bug1992868.pdf
!bug1937438_af_from_latex.pdf !bug1937438_af_from_latex.pdf
!bug1937438_from_word.pdf !bug1937438_from_word.pdf

BIN
test/pdfs/issue20439.pdf Normal file
View File

Binary file not shown.

7
test/test_manifest.json
View File

@ -2809,6 +2809,13 @@
"rounds": 1, "rounds": 1,
"type": "eq" "type": "eq"
}, },
{
"id": "issue20439",
"file": "pdfs/issue20439.pdf",
"md5": "3c7e888b26ff00943ec1610d93235efc",
"rounds": 1,
"type": "eq"
},
{ {
"id": "issue15942", "id": "issue15942",
"file": "pdfs/issue15942.pdf", "file": "pdfs/issue15942.pdf",