diff --git a/ChangeLog b/ChangeLog index 56a2be61..45b70fea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ 2021-11-04 Jay Berkenbilt + * Add range check in QPDFNumberTreeObjectHelper (fuzz issue 37740). + * Add QIntC::range_check_substract to do range checking on subtraction, which has different boundary conditions from addition. diff --git a/fuzz/qpdf_extra/37740.fuzz b/fuzz/qpdf_extra/37740.fuzz new file mode 100644 index 00000000..64189f69 Binary files /dev/null and b/fuzz/qpdf_extra/37740.fuzz differ diff --git a/libqpdf/QPDFNumberTreeObjectHelper.cc b/libqpdf/QPDFNumberTreeObjectHelper.cc index be2f2f16..7f510497 100644 --- a/libqpdf/QPDFNumberTreeObjectHelper.cc +++ b/libqpdf/QPDFNumberTreeObjectHelper.cc @@ -1,5 +1,6 @@ #include #include +#include class NumberTreeDetails: public NNTreeDetails { @@ -235,6 +236,7 @@ QPDFNumberTreeObjectHelper::findObjectAtOrBelow( return false; } oh = i->second; + QIntC::range_check_substract(idx, i->first); offset = idx - i->first; return true; }