Browse code

bb12158: Adding length check and updating len variable.

Micah Snyder (micasnyd) authored on 2018/09/19 09:30:59
Showing 1 changed files
... ...
@@ -1880,9 +1880,10 @@ static char *pdf_readstring(const char *q0, int len, const char *key, unsigned *
1880 1880
         return s0;
1881 1881
     }
1882 1882
 
1883
-    if (*q == '<') {
1883
+    if ((*q == '<') && (len >= 3))  {
1884 1884
         start = ++q;
1885
-        q = memchr(q+1, '>', len);
1885
+        len--;
1886
+        q = memchr(q+1, '>', len-1);
1886 1887
         if (!q)
1887 1888
             return NULL;
1888 1889