Skip to content

Null-pointer dereference looking for MediaBox in parse_pagenode

Observed with 3a87da19af392efc076f52620d2b0f9c86b1ed7893b0a88453a85f176863bc59.

Stacktrace:

#0  parse_pagenode (aux=0x7f7ffffe7430, myNode=0x40cf1f7018, 
    myRef=0x40a4b60060, myDict=0x40b3dc8528, parent_t=0x3ff32cb568, 
    parent_n=0x7f7ffffe7480, arena=0x3feaf39ac0) at pdf.c:3972
3972            if (item->token_type == TT_SEQUENCE) {
(gdb) bt
#0  parse_pagenode (aux=0x7f7ffffe7430, myNode=0x40cf1f7018, 
    myRef=0x40a4b60060, myDict=0x40b3dc8528, parent_t=0x3ff32cb568, 
    parent_n=0x7f7ffffe7480, arena=0x3feaf39ac0) at pdf.c:3972
#1  0x0000003de5f85116 in parse_pagetree (aux=0x7f7ffffe7430, 
    myNode=0x7f7ffffe7480, myRef=0x3ff32cb568, myDict=0x40c4f94508, 
    parent_t=0x0, parent_n=0x0) at pdf.c:4243
#2  0x0000003de5f853c8 in parse_catalog (aux=0x7f7ffffe7430, root=0x401d9a9338)
    at pdf.c:4314
#3  0x0000003de5f86a5f in parse_xrefs (aux=0x7f7ffffe7430) at pdf.c:4932
#4  0x0000003de5f86fd9 in main (argc=1, argv=0x7f7ffffe7608) at pdf.c:5071
Current language:  auto; currently minimal
(gdb) print item
$1 = (const HParsedToken *) 0x0

Code context (pdf.c, parse_pagenode):

    // Hold on to the mediaBox (page dimensions)-- required
    item = dictentry(myDict, "MediaBox"); // inheritable if not NULL
    if (item) {
        item = resolve(aux, item);
        if (item->token_type == TT_SEQUENCE) {