octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-05-29 00:10:54 +00:00
Code Issues Releases Wiki Activity

Don't interpret word tokens in content streams (fixes #82)

Browse Source
This commit is contained in:
Jay Berkenbilt 2017-07-26 05:35:34 -04:00
parent 701b518d5c
commit 12db09898e
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,5 +1,8 @@
2017-07-26 Jay Berkenbilt <ejb@ql.org> 2017-07-26 Jay Berkenbilt <ejb@ql.org>
* Don't attempt to interpret syntactic keywords (like R and
endobj) found while parsing content streams.
* Detect infinite loops while resolving objects. This could happen * Detect infinite loops while resolving objects. This could happen
if something inside an object that had to be resolved during if something inside an object that had to be resolved during
parsing, such as a stream length, recursively referenced the parsing, such as a stream length, recursively referenced the

10
libqpdf/QPDFObjectHandle.cc
View File

@ -964,7 +964,11 @@ QPDFObjectHandle::parseInternal(PointerHolder<InputSource> input,
case QPDFTokenizer::tt_word: case QPDFTokenizer::tt_word:
{ {
std::string const& value = token.getValue(); std::string const& value = token.getValue();
if ((value == "R") && (in_array || in_dictionary) && if (content_stream)
{
object = QPDFObjectHandle::newOperator(value);
}
else if ((value == "R") && (in_array || in_dictionary) &&
(olist.size() >= 2) && (olist.size() >= 2) &&
(! olist.at(olist.size() - 1).isIndirect()) && (! olist.at(olist.size() - 1).isIndirect()) &&
(olist.at(olist.size() - 1).isInteger()) && (olist.at(olist.size() - 1).isInteger()) &&
@ -996,10 +1000,6 @@ QPDFObjectHandle::parseInternal(PointerHolder<InputSource> input,
input->seek(input->getLastOffset(), SEEK_SET); input->seek(input->getLastOffset(), SEEK_SET);
empty = true; empty = true;
} }
else if (content_stream)
{
object = QPDFObjectHandle::newOperator(token.getValue());
}
else else
{ {
throw QPDFExc(qpdf_e_damaged_pdf, input->getName(), throw QPDFExc(qpdf_e_damaged_pdf, input->getName(),