diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt index 73ecced1..233a4571 100644 --- a/fuzz/CMakeLists.txt +++ b/fuzz/CMakeLists.txt @@ -114,6 +114,7 @@ set(CORPUS_OTHER 65681.fuzz 65773.fuzz 65777.fuzz + 68374.fuzz 68377.fuzz ) diff --git a/fuzz/qpdf_extra/68374.fuzz b/fuzz/qpdf_extra/68374.fuzz new file mode 100644 index 00000000..748bad92 Binary files /dev/null and b/fuzz/qpdf_extra/68374.fuzz differ diff --git a/fuzz/qtest/fuzz.test b/fuzz/qtest/fuzz.test index 3ba93156..38590d4c 100644 --- a/fuzz/qtest/fuzz.test +++ b/fuzz/qtest/fuzz.test @@ -21,7 +21,7 @@ my @fuzzers = ( ['pngpredictor' => 1], ['runlength' => 6], ['tiffpredictor' => 2], - ['qpdf' => 57], # increment when adding new files + ['qpdf' => 58], # increment when adding new files ); my $n_tests = 0; diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index d5e9c7c8..ed32b386 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -1195,7 +1195,9 @@ QPDF::insertFreeXrefEntry(QPDFObjGen og) void QPDF::insertReconstructedXrefEntry(int obj, qpdf_offset_t f1, int f2) { - if (!(obj > 0 && 0 <= f2 && f2 < 65535)) { + // Various tables are indexed by object id, with potential size id + 1 + constexpr static int max_id = std::numeric_limits::max() - 1; + if (!(obj > 0 && obj <= max_id && 0 <= f2 && f2 < 65535)) { QTC::TC("qpdf", "QPDF xref overwrite invalid objgen"); return; }