mORMot Open Source

blabulabul

Member

Registered: 2012-09-25

Posts: 2

Bug in SynPDF.pas

Hi,

function TPdfWrite.AddUnicodeHex in SynPDF.pas rewrites memory and causes crashes. Here is a fix:

...
begin
  repeat
    L := WideCharCount;
    if B+L*4>=Bend then begin
      Save;
      if L*4>high(Tmp) then
        L := high(Tmp) shr 2; // max WideCharCount allowed in Tmp[]
    end;
    BinToHex4(pointer(PW),B,L);
    inc(PtrInt(PW),L*2);
    inc(B,L*4);
    dec(WideCharCount,L);
  until WideCharCount=0;
  result := self;
end;

blabulabul

blabulabul

Member

Registered: 2012-09-25

Posts: 2

Re: Bug in SynPDF.pas

In TPdfWrite.AddHex is similar bug, there must be:

...
    if B+L*2>=Bend then begin
...

b.

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,660

Website

Re: Bug in SynPDF.pas

Nice catch!

I think this was the cause of a random GPF in SynPDF which never occurred for me, but may have for other users.

It is now fixed by http://synopse.info/fossil/info/010393f034

Thanks a lot for the report!