octoleo
/
qpdf
mirror of https://github.com/qpdf/qpdf.git
2
1
Fork 0
Code Issues Releases Wiki Activity

Guard against object id == std::numeric_limits<int> in QPDF::insertReconstructedXrefEntry

This commit is contained in:
m-holger 2024-04-30 10:58:31 +01:00
parent 60c7d594b8
commit e85b98b7e8
4 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fuzz/CMakeLists.txt
View File

@ -114,6 +114,7 @@ set(CORPUS_OTHER
65681.fuzz
65773.fuzz
65777.fuzz
68374.fuzz
68377.fuzz
)

BIN
fuzz/qpdf_extra/68374.fuzz Normal file
View File

Binary file not shown.

2
fuzz/qtest/fuzz.test
View File

@ -21,7 +21,7 @@ my @fuzzers = (
['pngpredictor' => 1],
['runlength' => 6],
['tiffpredictor' => 2],
['qpdf' => 57], # increment when adding new files
['qpdf' => 58], # increment when adding new files
);
my $n_tests = 0;

4
libqpdf/QPDF.cc
View File

@ -1195,7 +1195,9 @@ QPDF::insertFreeXrefEntry(QPDFObjGen og)
void
QPDF::insertReconstructedXrefEntry(int obj, qpdf_offset_t f1, int f2)
{
if (!(obj > 0 && 0 <= f2 && f2 < 65535)) {
// Various tables are indexed by object id, with potential size id + 1
constexpr static int max_id = std::numeric_limits<int>::max() - 1;
if (!(obj > 0 && obj <= max_id && 0 <= f2 && f2 < 65535)) {
QTC::TC("qpdf", "QPDF xref overwrite invalid objgen");
return;
}