octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2025-01-03 15:17:29 +00:00
Code Issues Releases Wiki Activity

Fix fuzz issues 15316 and 15390

Browse Source
This commit is contained in:
Jay Berkenbilt 2019-08-27 17:57:38 -04:00
parent 456c285b02
commit dadf8307c8
3 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fuzz/qpdf_extra/15316.fuzz Normal file
View File

@ -0,0 +1,3 @@
1 0 obj<<2147483647 0 R>>
endobj
trailer<</Root 1 0 R>>

BIN
fuzz/qpdf_extra/15390.fuzz Normal file
View File

Binary file not shown.

6
libqpdf/QPDF.cc
View File

@ -4,6 +4,7 @@
#include <vector> #include <vector>
#include <map> #include <map>
#include <algorithm> #include <algorithm>
#include <limits>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <memory.h> #include <memory.h>
@ -2151,6 +2152,11 @@ QPDFObjectHandle
QPDF::makeIndirectObject(QPDFObjectHandle oh) QPDF::makeIndirectObject(QPDFObjectHandle oh)
{ {
int max_objid = toI(getObjectCount()); int max_objid = toI(getObjectCount());
if (max_objid == std::numeric_limits<int>::max())
{
throw std::range_error(
"max object id is too high to create new objects");
}
QPDFObjGen next(max_objid + 1, 0); QPDFObjGen next(max_objid + 1, 0);
this->m->obj_cache[next] = this->m->obj_cache[next] =
ObjCache(QPDFObjectHandle::ObjAccessor::getObject(oh), -1, -1); ObjCache(QPDFObjectHandle::ObjAccessor::getObject(oh), -1, -1);