From 3316d33a4ea02651c09e083ca9dac06d8185f1f3 Mon Sep 17 00:00:00 2001 From: jpirnay Date: Thu, 7 May 2026 22:20:10 +0200 Subject: [PATCH] Review comments --- lib/Epub/Epub/Page.cpp | 4 ++++ lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp | 1 + 2 files changed, 5 insertions(+) diff --git a/lib/Epub/Epub/Page.cpp b/lib/Epub/Epub/Page.cpp index bf0e2159..907ad492 100644 --- a/lib/Epub/Epub/Page.cpp +++ b/lib/Epub/Epub/Page.cpp @@ -160,6 +160,10 @@ std::unique_ptr PageTableFragment::deserialize(FsFile& file) serialization::readPod(file, cell.isHeader); uint8_t lineCount; serialization::readPod(file, lineCount); + if (lineCount > MAX_CELL_LINES) { + LOG_ERR("PGE", "TableFragment: invalid lineCount %u at row %u cell %u", lineCount, r, c); + return nullptr; + } cell.lines.reserve(lineCount); for (uint8_t l = 0; l < lineCount; l++) { auto tb = TextBlock::deserialize(file); diff --git a/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp b/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp index c844f54f..adc1d355 100644 --- a/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp +++ b/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp @@ -1315,6 +1315,7 @@ void XMLCALL ChapterHtmlSlimParser::endElement(void* userData, const XML_Char* n if (self->currentTable && self->currentTable->depth > 1 && strcmp(name, "table") == 0) { self->partWordBufferIndex = 0; self->currentTable->depth -= 1; + self->depth -= 1; LOG_DBG("EHP", "nested table end, depth now %d", self->currentTable->depth); return; }