vcl/source/filter/ipdf/pdfdocument.cxx |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit 8400b5bf0d116b8ed193696820beeb812e89a9ac
Author:     Justin Luth <justin.l...@collabora.com>
AuthorDate: Mon Oct 7 15:29:38 2024 -0400
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Oct 8 15:18:39 2024 +0200

    avoid PDF export crash when ReadWithPossibleFixup falls back to Pdfium
    
    Unfortunately, I failed to create a clean-room example,
    even when I pasted some binary garbage at the end of the file.
    Somehow I was getting a sanitized version from getAsStream.
    
    In any case, this prevents crashing with the two examples I have,
    although there are still significant problems somewhere
    because the export just results in empty pages...
    
    The problem is that reading again with the Pdfium-fixed version
    gets mixed in with the original read results,
    and things get pretty garbled.
    Probably m_rElements and everything needs to be cleared
    before tokenizing the fixup-version.
    
    Change-Id: I01daefa23b8f92e2849d71bca269ba2b476199da
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/174648
    Reviewed-by: Justin Luth <jl...@mail.com>
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    (cherry picked from commit 636e703722c1a36b4078de932b5a44855145c18a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/174663
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/vcl/source/filter/ipdf/pdfdocument.cxx 
b/vcl/source/filter/ipdf/pdfdocument.cxx
index dac68d5344af..b5fbc757da57 100644
--- a/vcl/source/filter/ipdf/pdfdocument.cxx
+++ b/vcl/source/filter/ipdf/pdfdocument.cxx
@@ -1427,6 +1427,7 @@ bool PDFDocument::Read(SvStream& rStream)
             nStartXRef = pPrev->GetValue();
 
         // Reset state, except the edit buffer.
+        m_aOffsetTrailers.clear(); // contents are lifecycle managed by 
m_aElements
         m_aElements.clear();
         m_aOffsetObjects.clear();
         m_aIDObjects.clear();

Reply via email to