commit 431c7db3b7ea3e2db9cc7066cb5334e4bb7dcb75 from: Sven M. Hallberg date: Thu Mar 30 13:27:46 2023 UTC remove useless/erroneous condition The offset can never be negative (size_t is unsigned). And this treated offset = 0 as out of bounds, which is nonsense. In fact, offset == size is also not invalid (it is the end of file). commit - 9883a543682945509e8b20b5e9444e1b52876a09 commit + 431c7db3b7ea3e2db9cc7066cb5334e4bb7dcb75 blob - 112a0d53be2dafe5e3c0328ec987519d77a1616e blob + 0fb055a5c037d5f0e86c5884c8339d228849f0a9 --- pdf.c +++ pdf.c @@ -4978,7 +4978,7 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *n // verify the offset recovered is bounded to be in the file // XXX this check is already present below by virtue of h_seek() - if ( (offset <=0) || (offset >= sz) ) { + if (offset > sz) { log_message(5, "VIOLATION[5]: Invalid xref table offset = %ld. Valid range <0, %ld>\n", offset, sz); goto end;