octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2025-02-02 11:58:25 +00:00
Code Issues Releases Wiki Activity

Fix fuzz issue 15387 (overflow checking xref size)

Browse Source
This commit is contained in:
Jay Berkenbilt 2019-08-27 10:16:18 -04:00
parent 6bc4cc3d48
commit ac5e6de2e8
5 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fuzz/qpdf_extra/15387.fuzz Normal file
View File

@ -0,0 +1,2 @@
xref 2147483647 1 1 5 fstartxref 2
trailer<</Size 0>>

6
libqpdf/QPDF.cc
View File

@ -672,14 +672,14 @@ QPDF::read_xref(qpdf_offset_t xref_offset)
{ {
max_obj = std::max(max_obj, *(this->m->deleted_objects.rbegin())); max_obj = std::max(max_obj, *(this->m->deleted_objects.rbegin()));
} }
if (size != max_obj + 1) if (size - 1 != max_obj)
{ {
QTC::TC("qpdf", "QPDF xref size mismatch"); QTC::TC("qpdf", "QPDF xref size mismatch");
warn(QPDFExc(qpdf_e_damaged_pdf, this->m->file->getName(), "", 0, warn(QPDFExc(qpdf_e_damaged_pdf, this->m->file->getName(), "", 0,
std::string("reported number of objects (") + std::string("reported number of objects (") +
QUtil::int_to_string(size) + QUtil::int_to_string(size) +
") inconsistent with actual number of objects (" + ") is not one plus the highest object number (" +
QUtil::int_to_string(max_obj + 1) + ")")); QUtil::int_to_string(max_obj) + ")"));
} }
// We no longer need the deleted_objects table, so go ahead and // We no longer need the deleted_objects table, so go ahead and

2
qpdf/qtest/qpdf/bad12-recover.out
View File

@ -1,4 +1,4 @@
WARNING: bad12.pdf: reported number of objects (9) inconsistent with actual number of objects (8) WARNING: bad12.pdf: reported number of objects (9) is not one plus the highest object number (7)
/QTest is implicit /QTest is implicit
/QTest is direct and has type null (2) /QTest is direct and has type null (2)
/QTest is null /QTest is null

2
qpdf/qtest/qpdf/bad12.out
View File

@ -1,4 +1,4 @@
WARNING: bad12.pdf: reported number of objects (9) inconsistent with actual number of objects (8) WARNING: bad12.pdf: reported number of objects (9) is not one plus the highest object number (7)
/QTest is implicit /QTest is implicit
/QTest is direct and has type null (2) /QTest is direct and has type null (2)
/QTest is null /QTest is null

2
qpdf/qtest/qpdf/issue-51.out
View File

@ -1,5 +1,5 @@
WARNING: issue-51.pdf: can't find PDF header WARNING: issue-51.pdf: can't find PDF header
WARNING: issue-51.pdf: reported number of objects (0) inconsistent with actual number of objects (9) WARNING: issue-51.pdf: reported number of objects (0) is not one plus the highest object number (8)
WARNING: issue-51.pdf (object 7 0, offset 553): expected endobj WARNING: issue-51.pdf (object 7 0, offset 553): expected endobj
WARNING: issue-51.pdf (object 1 0, offset 359): expected endobj WARNING: issue-51.pdf (object 1 0, offset 359): expected endobj
WARNING: issue-51.pdf (offset 70): loop detected resolving object 2 0 WARNING: issue-51.pdf (offset 70): loop detected resolving object 2 0