From 60c7d594b835ae2eac8235658179aedce7b3b007 Mon Sep 17 00:00:00 2001
From: m-holger <m-holger@kubitscheck.org>
Date: Tue, 30 Apr 2024 10:46:06 +0100
Subject: [PATCH] In QPDF::filterCompressedObjects ignore objects not in
 QPDFWriter tables

Add fuzz case 68377.
---
 fuzz/CMakeLists.txt          |   1 +
 fuzz/qpdf_extra/68377.fuzz   | Bin 0 -> 124 bytes
 fuzz/qtest/fuzz.test         |   2 +-
 libqpdf/QPDF_optimization.cc |  24 ++++++++++++++----------
 libqpdf/qpdf/ObjTable.hh     |   6 ++++++
 5 files changed, 22 insertions(+), 11 deletions(-)
 create mode 100644 fuzz/qpdf_extra/68377.fuzz

diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt
index efa71528..73ecced1 100644
--- a/fuzz/CMakeLists.txt
+++ b/fuzz/CMakeLists.txt
@@ -114,6 +114,7 @@ set(CORPUS_OTHER
   65681.fuzz
   65773.fuzz
   65777.fuzz
+  68377.fuzz
 )
 
 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
diff --git a/fuzz/qpdf_extra/68377.fuzz b/fuzz/qpdf_extra/68377.fuzz
new file mode 100644
index 0000000000000000000000000000000000000000..61ce0e221693693eb03e82db597b8a558008b02e
GIT binary patch
literal 124
zcmY!|G*U27$WO|$v57VVvVs&0EiFKFteqXNDNIV=Ei<PiwMgGBM?WY(zeEA7DM&v!
zvno}=&`>|5vLIDIA}BRYKRnt{!C1i%sJXbLC^a!xA>&?B5(A^!|7HIjgcv=KrRJqT
JCH^b?2LLgpCVl__

literal 0
HcmV?d00001

diff --git a/fuzz/qtest/fuzz.test b/fuzz/qtest/fuzz.test
index 7235140d..3ba93156 100644
--- a/fuzz/qtest/fuzz.test
+++ b/fuzz/qtest/fuzz.test
@@ -21,7 +21,7 @@ my @fuzzers = (
     ['pngpredictor' => 1],
     ['runlength' => 6],
     ['tiffpredictor' => 2],
-    ['qpdf' => 56],             # increment when adding new files
+    ['qpdf' => 57],             # increment when adding new files
     );
 
 my $n_tests = 0;
diff --git a/libqpdf/QPDF_optimization.cc b/libqpdf/QPDF_optimization.cc
index 9f423a3a..75615436 100644
--- a/libqpdf/QPDF_optimization.cc
+++ b/libqpdf/QPDF_optimization.cc
@@ -416,22 +416,26 @@ QPDF::filterCompressedObjects(QPDFWriter::ObjTable const& obj)
         ObjUser const& ou = i1.first;
         // Loop over objects.
         for (auto const& og: i1.second) {
-            if (auto const& i2 = obj[og].object_stream; i2 <= 0) {
-                t_obj_user_to_objects[ou].insert(og);
-            } else {
-                t_obj_user_to_objects[ou].insert(QPDFObjGen(i2, 0));
+            if (obj.contains(og)) {
+                if (auto const& i2 = obj[og].object_stream; i2 <= 0) {
+                    t_obj_user_to_objects[ou].insert(og);
+                } else {
+                    t_obj_user_to_objects[ou].insert(QPDFObjGen(i2, 0));
+                }
             }
         }
     }
 
     for (auto const& i1: m->object_to_obj_users) {
         QPDFObjGen const& og = i1.first;
-        // Loop over obj_users.
-        for (auto const& ou: i1.second) {
-            if (auto i2 = obj[og].object_stream; i2 <= 0) {
-                t_object_to_obj_users[og].insert(ou);
-            } else {
-                t_object_to_obj_users[QPDFObjGen(i2, 0)].insert(ou);
+        if (obj.contains(og)) {
+            // Loop over obj_users.
+            for (auto const& ou: i1.second) {
+                if (auto i2 = obj[og].object_stream; i2 <= 0) {
+                    t_object_to_obj_users[og].insert(ou);
+                } else {
+                    t_object_to_obj_users[QPDFObjGen(i2, 0)].insert(ou);
+                }
             }
         }
     }
diff --git a/libqpdf/qpdf/ObjTable.hh b/libqpdf/qpdf/ObjTable.hh
index 1f0f8a2b..84b51b78 100644
--- a/libqpdf/qpdf/ObjTable.hh
+++ b/libqpdf/qpdf/ObjTable.hh
@@ -62,6 +62,12 @@ class ObjTable: public std::vector<T>
         return idx < std::vector<T>::size() || sparse_elements.count(idx);
     }
 
+    inline bool
+    contains(QPDFObjGen og) const
+    {
+        return contains(static_cast<size_t>(og.getObj()));
+    }
+
     inline bool
     contains(QPDFObjectHandle oh) const
     {