<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">Submitted By: Ken Moffat &lt;ken at linuxfromscratch dot org&gt;
Date: 2016-08-30
Initial Package Version: 1.9 (possibly applies to 1.5 and 1.7 versions)
Upstream Status: Applied
Origin: Upstream
Description: Fixes use after free, upstream bug 696941, CVE-2016-6265.

diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index 576c315..3222599 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -1184,8 +1184,14 @@ pdf_load_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
 				fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", (int)entry-&gt;ofs, i);
 		}
 		if (entry-&gt;type == 'o')
-			if (entry-&gt;ofs &lt;= 0 || entry-&gt;ofs &gt;= xref_len || pdf_get_xref_entry(ctx, doc, entry-&gt;ofs)-&gt;type != 'n')
-				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)entry-&gt;ofs, i);
+		{
+			/* Read this into a local variable here, because pdf_get_xref_entry
+			 * may solidify the xref, hence invalidating "entry", meaning we
+			 * need a stashed value for the throw. */
+			fz_off_t ofs = entry-&gt;ofs;
+			if (ofs &lt;= 0 || ofs &gt;= xref_len || pdf_get_xref_entry(ctx, doc, ofs)-&gt;type != 'n')
+				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
+		}
 	}
 }
 
</pre></body></html>