octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-12-22 19:08:59 +00:00
Code Issues Releases Wiki Activity

Fix fuzz issue 16172 (overflow checking in OffsetInputSource)

Browse Source
This commit is contained in:
Jay Berkenbilt 2019-08-27 10:58:20 -04:00
parent ad8081daf5
commit 456c285b02
3 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fuzz/qpdf_extra/16172.fuzz Normal file
View File

@ -0,0 +1 @@
˙%PDF-1.4startxref 9223372036854775805

23
libqpdf/OffsetInputSource.cc
View File

@ -1,10 +1,20 @@
#include <qpdf/OffsetInputSource.hh>
#include <limits>
#include <sstream>
#include <stdexcept>
OffsetInputSource::OffsetInputSource(PointerHolder<InputSource> proxied,
qpdf_offset_t global_offset) :
proxied(proxied),
global_offset(global_offset)
{
if (global_offset < 0)
{
throw std::logic_error(
"OffsetInputSource constructed with negative offset");
}
this->max_safe_offset =
std::numeric_limits<qpdf_offset_t>::max() - global_offset;
}
OffsetInputSource::~OffsetInputSource()
@ -34,12 +44,25 @@ OffsetInputSource::seek(qpdf_offset_t offset, int whence)
{
if (whence == SEEK_SET)
{
if (offset > this->max_safe_offset)
{
std::ostringstream msg;
msg << "seeking to " << offset
<< " offset by " << global_offset
<< " would cause an overflow of the offset type";
throw std::range_error(msg.str());
}
this->proxied->seek(offset + global_offset, whence);
}
else
{
this->proxied->seek(offset, whence);
}
if (tell() < 0)
{
throw std::runtime_error(
"offset input source: seek before beginning of file");
}
}
void

1
libqpdf/qpdf/OffsetInputSource.hh
View File

@ -24,6 +24,7 @@ class OffsetInputSource: public InputSource
private:
PointerHolder<InputSource> proxied;
qpdf_offset_t global_offset;
qpdf_offset_t max_safe_offset;
};
#endif // QPDF_OFFSETINPUTSOURCE_HH