diff --git a/pdf.c b/pdf.c index 04e077d7770c356c450863f0601ea7238b17d119..ed6afd0326403345282b893da4fea696848d9f41 100644 --- a/pdf.c +++ b/pdf.c @@ -4972,18 +4972,15 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *nxrefs) goto end; } offset = H_INDEX_UINT(res->ast, 0); - - // XXX put many checks here into semantic validations in the parser... - // e.g. offset bounds, /Prev type/value, loop detection - - // verify the offset recovered is bounded to be in the file - // XXX this check is already present below by virtue of h_seek() if (offset > sz) { log_message(5, "%s: startxref value at %zu (%#zx) points " "outside the file\n", sz - i, sz - i); goto end; } + // XXX put many checks here also into semantic validations in the + // parser... e.g. offset bounds, /Prev type/value, loop detection + // XXX try formulating this loop as one parser using h_seek and h_bind for (;;) { assert(offset <= sz);