octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-05-28 16:00:53 +00:00
Code Issues Releases Wiki Activity

Merge pull request #1126 from m-holger/fuzz65777

Browse Source 
Fix incorrect handling of invalid negative object ids
This commit is contained in:
Jay Berkenbilt 2024-01-17 07:54:24 -05:00 committed by GitHub
commit 9a6a1cce93
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fuzz/CMakeLists.txt
View File

@ -111,6 +111,8 @@ set(CORPUS_OTHER
37740.fuzz
57639.fuzz
65681.fuzz
65773.fuzz
65777.fuzz
)
set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)

1
fuzz/qpdf_extra/65773.fuzz Normal file
View File

@ -0,0 +1 @@
trailer<</Root<<[-2147483648 7 R 8 4 R]>>>>

BIN
fuzz/qpdf_extra/65777.fuzz Normal file
View File

Binary file not shown.

2
fuzz/qtest/fuzz.test
View File

@ -20,7 +20,7 @@ my @fuzzers = (
['pngpredictor' => 1],
['runlength' => 6],
['tiffpredictor' => 1],
['qpdf' => 54], # increment when adding new files
['qpdf' => 56], # increment when adding new files
);
my $n_tests = 0;

9
libqpdf/QPDF.cc
View File

@ -709,10 +709,11 @@ QPDF::read_xref(qpdf_offset_t xref_offset)
// Make sure we keep only the highest generation for any object.
QPDFObjGen last_og{-1, 0};
for (auto const& og: m->xref_table) {
if (og.first.getObj() == last_og.getObj())
for (auto const& item: m->xref_table) {
auto id = item.first.getObj();
if (id == last_og.getObj() && id > 0)
removeObject(last_og);
last_og = og.first;
last_og = item.first;
}
}
@ -2405,7 +2406,7 @@ QPDF::getCompressibleObjGens()
while (!queue.empty()) {
auto obj = queue.back();
queue.pop_back();
if (obj.isIndirect()) {
if (obj.getObjectID() > 0) {
QPDFObjGen og = obj.getObjGen();
const size_t id = toS(og.getObj() - 1);
if (id >= max_obj)