fix trailer_end check

14 years ago · 6dcf6031db
parent 82c0e6bc31
commit 6dcf6031db
1 changed files with 1 additions and 1 deletions
--- a/libclamav/pdf.c
+++ b/libclamav/pdf.c
@ -955,7 +955,7 @@ static void pdf_parseobj(struct pdf_struct *pdf, struct pdf_obj *obj)
 	    pdfobj_flag(pdf, obj, LINEARIZED_PDF);
 	    objstate = STATE_NONE;
 	    trailer_end = pdf_readint(q, dict_length, "/H");
-	    if (trailer_end > 0) {
+	    if (trailer_end > 0 && trailer_end < pdf->size) {
 		trailer = trailer_end - 1024;
 		if (trailer < 0) trailer = 0;
 		q2 = pdf->map + trailer;