Fix a potential heap overflow bug with the table-of-contents (Issue #467)

Author: michaelrsweet

CHANGES.md

@@ -5,6 +5,7 @@
 - Fixed a potential stack overflow bug with GIF images (Issue #463)
 - Fixed a potential heap underflow bug with empty attributes (Issue #464)
 - Fixed a potential stack overflow bug with BMP images (Issue #466)
+- Fixed a potential heap overflow bug with the table-of-contents (Issue #467)
 - Fixed a potential heap overflow bug with headings (Issue #468)
 
 

htmldoc/ps-pdf.cxx

@@ -2838,6 +2838,9 @@ pdf_write_contents(FILE   *out,			/* I - Output file */
     * This is for the Table of Contents page...
     */
 
+    if (chapter_starts[0] < 0 || chapter_starts[0] >= (int)num_pages)
+      return;
+
     thisobj = pdf_start_object(out);
 
     fprintf(out, "/Parent %d 0 R", parent);