From 819101eaa54e471fd7eccdfafb8eaf74094a49ed Mon Sep 17 00:00:00 2001 From: Antia Puentes Date: Tue, 30 Jul 2013 19:33:12 +0200 Subject: ev-view-accessible: Fix a crash in ev_view_accessible_get_link Check array limits returning early if the link index is out of range. https://bugzilla.gnome.org/show_bug.cgi?id=705155 https://git.gnome.org/browse/evince/commit/?h=gnome-3-10&id=7eac53f --- libview/ev-view-accessible.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libview/ev-view-accessible.c b/libview/ev-view-accessible.c index 987079cd..6529d3cc 100644 --- a/libview/ev-view-accessible.c +++ b/libview/ev-view-accessible.c @@ -998,6 +998,9 @@ ev_view_accessible_get_link (AtkHypertext *hypertext, EvMapping *mapping; EvLinkAccessible *atk_link; + if (link_index < 0) + return NULL; + widget = gtk_accessible_get_widget (GTK_ACCESSIBLE (hypertext)); if (widget == NULL) /* State is defunct */ @@ -1018,6 +1021,9 @@ ev_view_accessible_get_link (AtkHypertext *hypertext, return NULL; n_links = ev_mapping_list_length (link_mapping); + if (link_index > n_links - 1) + return NULL; + mapping = ev_mapping_list_nth (link_mapping, n_links - link_index - 1); atk_link = ev_link_accessible_new (EV_VIEW_ACCESSIBLE (hypertext), EV_LINK (mapping->data), -- cgit v1.2.1