octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-05-31 09:20:52 +00:00
Code Issues Releases Wiki Activity

Prevent a division by zero error (fixes #141)

Browse Source 
Bad /W in an xref stream could cause a division by zero error. Now
this is handled as a special case.
This commit is contained in:
Jay Berkenbilt 2017-08-11 20:10:28 -04:00
parent 8fe0b06cd8
commit 46611f0710
7 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libqpdf/QPDF.cc
View File

@ -917,6 +917,13 @@ QPDF::processXRefStream(qpdf_offset_t xref_offset, QPDFObjectHandle& xref_obj)
}
entry_size += W[i];
}
if (entry_size == 0)
{
throw QPDFExc(qpdf_e_damaged_pdf, this->file->getName(),
"xref stream", xref_offset,
"Cross-reference stream's /W indicates"
" entry size of 0");
}
long long max_num_entries =
static_cast<unsigned long long>(-1) / entry_size;

4
libqpdf/QPDFWriter.cc
View File

@ -2056,6 +2056,10 @@ QPDFWriter::generateObjectStreams()
std::vector<QPDFObjGen> const& eligible =
QPDF::Writer::getCompressibleObjGens(this->pdf);
unsigned int n_object_streams = (eligible.size() + 99) / 100;
if (n_object_streams == 0)
{
throw std::logic_error("n_object_streams == 0");
}
unsigned int n_per = eligible.size() / n_object_streams;
if (n_per * n_object_streams < eligible.size())
{

2
qpdf/qtest/qpdf.test
View File

@ -218,6 +218,8 @@ my @bug_tests = (
["119", "other infinite loop", 3],
["120", "other infinite loop", 3],
["106", "zlib data error", 3],
["141a", "/W entry size 0", 2],
["141b", "/W entry size 0", 2],
);
$n_tests += scalar(@bug_tests);
foreach my $d (@bug_tests)

8
qpdf/qtest/qpdf/issue-141a.out Normal file
View File

@ -0,0 +1,8 @@
WARNING: issue-141a.pdf: can't find PDF header
WARNING: issue-141a.pdf (xref stream: object 9 0, file position 10): stream dictionary lacks /Length key
WARNING: issue-141a.pdf (xref stream: object 9 0, file position 47): attempting to recover stream length
WARNING: issue-141a.pdf (xref stream: object 9 0, file position 47): unable to recover stream data; treating stream as empty
WARNING: issue-141a.pdf: file is damaged
WARNING: issue-141a.pdf (xref stream, file position 3): Cross-reference stream's /W indicates entry size of 0
WARNING: issue-141a.pdf: Attempting to reconstruct cross-reference table
issue-141a.pdf: unable to find trailer dictionary while recovering damaged file

6
qpdf/qtest/qpdf/issue-141a.pdf Normal file
View File

@ -0,0 +1,6 @@
0009 0 obj<</Type/XRef/Size 0/W[0 0 0]>>stream
endstream
endobj
startxref
3
%%EOF

5
qpdf/qtest/qpdf/issue-141b.out Normal file
View File

@ -0,0 +1,5 @@
WARNING: issue-141b.pdf: can't find PDF header
WARNING: issue-141b.pdf: file is damaged
WARNING: issue-141b.pdf (file position 7): xref not found
WARNING: issue-141b.pdf: Attempting to reconstruct cross-reference table
issue-141b.pdf: unable to find trailer dictionary while recovering damaged file

6
qpdf/qtest/qpdf/issue-141b.pdf Normal file
View File

@ -0,0 +1,6 @@
%PDF-100 0 obj<</Type/XRef/Size 0/[]/W[0 0 0]/ 0>>stream
0endstream
endobj
startxref
7
%%EOF