... | ... |
@@ -955,7 +955,7 @@ static void pdf_parseobj(struct pdf_struct *pdf, struct pdf_obj *obj) |
955 | 955 |
pdfobj_flag(pdf, obj, LINEARIZED_PDF); |
956 | 956 |
objstate = STATE_NONE; |
957 | 957 |
trailer_end = pdf_readint(q, dict_length, "/H"); |
958 |
- if (trailer_end > 0) { |
|
958 |
+ if (trailer_end > 0 && trailer_end < pdf->size) { |
|
959 | 959 |
trailer = trailer_end - 1024; |
960 | 960 |
if (trailer < 0) trailer = 0; |
961 | 961 |
q2 = pdf->map + trailer; |