diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt index 98c980d6..f5680a2f 100644 --- a/fuzz/CMakeLists.txt +++ b/fuzz/CMakeLists.txt @@ -122,6 +122,7 @@ set(CORPUS_OTHER 69913.fuzz 69969.fuzz 69977.fuzz + 70055.fuzz ) set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) diff --git a/fuzz/qpdf_extra/70055.fuzz b/fuzz/qpdf_extra/70055.fuzz new file mode 100644 index 00000000..078b2364 Binary files /dev/null and b/fuzz/qpdf_extra/70055.fuzz differ diff --git a/fuzz/qtest/fuzz.test b/fuzz/qtest/fuzz.test index 49ae52d9..7370c846 100644 --- a/fuzz/qtest/fuzz.test +++ b/fuzz/qtest/fuzz.test @@ -21,7 +21,7 @@ my @fuzzers = ( ['pngpredictor' => 1], ['runlength' => 6], ['tiffpredictor' => 2], - ['qpdf' => 64], # increment when adding new files + ['qpdf' => 65], # increment when adding new files ); my $n_tests = 0; diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index 451cdf70..e11e3006 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -1129,6 +1129,11 @@ QPDF::processXRefIndex( if (val.isInteger()) { if (i % 2) { auto count = val.getIntValue(); + if (count <= 0) { + throw damaged( + "Cross-reference stream section claims to contain " + + std::to_string(count) + " entries"); + } // We are guarding against the possibility of num_entries * entry_size // overflowing. We are not checking that entries are in ascending order as // required by the spec, which probably should generate a warning. We are also