2
1
mirror of https://github.com/qpdf/qpdf.git synced 2024-12-23 11:28:56 +00:00
Commit Graph

264 Commits

Author SHA1 Message Date
Jay Berkenbilt
2d5b854468 Allow reading command-line args from files (fixes #16) 2017-07-29 22:23:21 -04:00
Jay Berkenbilt
5993c3e83c Detect input file = output file (fixes #29) 2017-07-29 20:58:01 -04:00
Jay Berkenbilt
885b8781cc Allow --check to coexist with and precede other operations (fixes #42) 2017-07-29 19:56:21 -04:00
Jay Berkenbilt
b43a0ac237 When recover stream length, indicate the length (fixes #44) 2017-07-29 19:15:06 -04:00
Jay Berkenbilt
f37d399d82 Add newline-before-endstream option (fixes #103) 2017-07-29 12:21:38 -04:00
Jay Berkenbilt
6a7d53ad2b Handle zlib data errors better (fixes #106) 2017-07-29 12:19:04 -04:00
Jay Berkenbilt
07d6f770b2 Better recovery of bad stream start (fixes #104) 2017-07-29 12:19:04 -04:00
Jay Berkenbilt
b389268f16 Better handle split content streams (fixes #73)
When parsing content streams, allow content to be split arbitrarily
across stream boundaries.
2017-07-29 12:19:04 -04:00
Jay Berkenbilt
3a1ff5ded9 Add option to preserve unreferenced objects 2017-07-28 19:19:11 -04:00
Jay Berkenbilt
7f8892525f Add precheck streams capability
When requested, QPDFWriter will do more aggress prechecking of streams
to make sure it can actually succeed in decoding them before
attempting to do so. This will allow preservation of raw data even
when the raw data is corrupted relative to the specified filters.
2017-07-27 23:42:27 -04:00
Jay Berkenbilt
a4fd4b91c6 Convert stream filtering errors to warnings 2017-07-27 18:43:07 -04:00
Jay Berkenbilt
40f00122b8 Convert object parsing errors to warnings
QPDFObjectHandle::parseInternal now issues warnings instead of
throwing exceptions for all error conditions that it finds (except
internal logic errors) and has stronger recovery for things like
invalid tokens and malformed dictionaries. This should improve qpdf's
ability to recover from a wide range of broken files that currently
cause it to fail.
2017-07-27 18:20:31 -04:00
Jay Berkenbilt
ac3c81a8ed Include tests for other infinite loop bugs
fixes #117
fixes #118
fixes #119
fixes #120

Several other infinite loop bugs were fixed by previous changes.
Include their test files in the test suite.
2017-07-26 06:24:07 -04:00
Jay Berkenbilt
12db09898e Don't interpret word tokens in content streams (fixes #82) 2017-07-26 06:24:07 -04:00
Jay Berkenbilt
701b518d5c Detect recursion loops resolving objects (fixes #51)
During parsing of an object, sometimes parts of the object have to be
resolved. An example is stream lengths. If such an object directly or
indirectly points to the object being parsed, it can cause an infinite
loop. Guard against all cases of re-entrant resolution of objects.
2017-07-26 06:24:07 -04:00
Jay Berkenbilt
afe0242b26 Handle object ID 0 (fixes #99)
This is CVE-2017-9208.

The QPDF library uses object ID 0 internally as a sentinel to
represent a direct object, but prior to this fix, was not blocking
handling of 0 0 obj or 0 0 R as a special case. Creating an object in
the file with 0 0 obj could cause various infinite loops. The PDF spec
doesn't allow for object 0. Having qpdf handle object 0 might be a
better fix, but changing all the places in the code that assumes objid
== 0 means direct would be risky.
2017-07-26 06:24:07 -04:00
Jay Berkenbilt
315092dd98 Avoid xref reconstruction infinite loop (fixes #100)
This is CVE-2017-9209.
2017-07-26 06:24:07 -04:00
Jay Berkenbilt
603f222365 Fix infinite loop while reporting an error (fixes #101)
This is CVE-2017-9210.

The description string for an error message included unparsing an
object, which is too complex of a thing to try to do while throwing an
exception. There was only one example of this in the entire codebase,
so it is not a pervasive problem. Fixing this eliminated one class of
infinite loop errors.
2017-07-26 06:24:07 -04:00
Jay Berkenbilt
b7302a9b72 Prepare 6.0.0 release 2015-11-10 12:48:52 -05:00
Jay Berkenbilt
e5abc789a2 Prepare 5.2.0 release 2015-11-01 16:40:01 -05:00
Jay Berkenbilt
b62cbe2508 Tolerate some mangled xref tables
If xref table entries lack the spec-required trailing whitespace or
contain a small amount of extra space, handle them anyway.
2015-10-31 18:56:43 -04:00
Jay Berkenbilt
b8bdef0ad1 Implement deterministic ID
For non-encrypted files, determinstic ID generation uses file contents
instead of timestamp and file name. At a small runtime cost, this
enables generation of the same /ID if the same inputs are converted in
the same way multiple times.
2015-10-31 18:56:42 -04:00
Jay Berkenbilt
94e55394ed Prepare 5.1.3 release 2015-05-24 17:26:49 -04:00
Jay Berkenbilt
b356b9dfa2 fix-qdf: handle object streams with > 255 objects
fix-qdf was previously hard-coding the number of bytes for the f2
field of the xref stream entry. This addresses issue #37. Thanks
aluebcke for reporting.
2015-05-24 16:52:42 -04:00
Jay Berkenbilt
cf43882e9f Handle Microsoft crypt provider without prior keys
As reported in issue #40, a call to CryptAcquireContext in
SecureRandomDataProvider fails in a fresh windows install prior to any
user keys being created in AppData\Roaming\Microsoft\Crypto\RSA.

Thanks michalrames.
2015-05-24 16:52:42 -04:00
Jay Berkenbilt
857bb208d3 include time.h in QUtil.hh
QUtil.hh needs time.h to get time_t on some platforms. Thanks Peter
Korsgaard <peter@korsgaard.com>
2015-05-24 16:26:05 -04:00
Jay Berkenbilt
a11549a566 Detect loops in /Pages structure
Pushing inherited objects to pages and getting all pages were both
prone to stack overflow infinite loops if there were loops in the
Pages dictionary. There is a general weakness in the code in that any
part of the code that traverses the Pages structure would be prone to
this and would have to implement its own loop detection. A more robust
fix may provide some general method for handling the Pages structure,
but it's probably not worth doing.

Note: addition of *Internal2 private functions was done rather than
changing signatures of existing methods to avoid breaking
compatibility.
2015-02-21 19:47:11 -05:00
Jay Berkenbilt
28a9df5119 Avoid buffer overrun copying digest
Converting a password to an encryption key is supposed to copy up to a
certain number of bytes from a digest. Make sure never to copy more
than the size of the digest.
2015-02-21 17:51:08 -05:00
Jay Berkenbilt
c729e07d55 Avoid resolving arguments to R
When checking two objects preceding R while parsing, ensure that the
objects are direct. This avoids stuff like 1 0 obj containing 1 0 R 0 R
from causing an infinite loop in object resolution.
2015-02-21 17:51:08 -05:00
Jay Berkenbilt
d8900c2255 Handle page tree node with no /Type
Original reported here:
https://bugs.launchpad.net/ubuntu/+source/qpdf/+bug/1397413

The PDF specification says that the /Type key for nodes in the pages
dictionary (both /Page and /Pages) is required, but some PDF files
omit them. Use the presence of other keys to determine the type of
pages tree node this is if the type key is not found.
2014-12-29 10:17:21 -05:00
Jay Berkenbilt
caab1b0e16 Handle pages with no /Contents from getPageContents()
The spec allows /Contents to be omitted for pages that are blank, but
QPDFObjectHandle::getPageContents() was throwing an exception in this
case.
2014-11-14 13:43:34 -05:00
Jay Berkenbilt
4071db59aa Prepare 5.1.2 release 2014-06-07 17:16:52 -04:00
Jay Berkenbilt
3c5e602a1e Windows build (msvc): target Windows 5.0.1 (XP)
Without this, qpdf executables work only on Vista or newer.

Fixes #35
2014-06-07 17:16:50 -04:00
Jay Berkenbilt
0b2e9cb168 Example: fast split into single pages
This is faster than using qpdf --pages to do it.
2014-06-07 16:40:38 -04:00
Jay Berkenbilt
9f8aba1db7 Handle indirect stream filter/decode parameters
QPDFWriter was trying to make /Filter and /DecodeParms direct in all
cases, but there are some cases where /DecodeParms may refer to a
stream, which can't be direct. QPDFWriter doesn't actually need
/DecodeParms to be direct in that case because it won't be able to
filter the stream. Until we can handle this type of stream, just don't
make /Filter and /DecodeParms direct if we can't filter the stream
anyway.

Fixes #34
2014-06-07 16:31:03 -04:00
Jay Berkenbilt
b0a96ce6aa Fix calculation of xref stream stream columns
Fix problem: if the last object in the first part of a linearized file
had an offset that was below 65536 by less than the size of the hint
stream, the xref stream was invalid and the resulting file is not
usable.
2014-02-22 22:13:31 -05:00
Jay Berkenbilt
247d70efee Prepare 5.1.1 release 2014-01-14 15:45:35 -05:00
Jay Berkenbilt
c9a9fe9c2f Avoid traversing same object twice when copying objects
This is a performance fix.  The output is unchanged.

Fixes #28.
2013-12-26 11:51:50 -05:00
Jay Berkenbilt
0b6127558d Prepare 5.1.0 release 2013-12-17 15:26:07 -05:00
Jay Berkenbilt
235d8f28f8 Increase random data provider support
Add a method to get the current random data provider, and document and
test the method for resetting it.
2013-12-16 16:21:28 -05:00
Jay Berkenbilt
30287d2d65 Allow OS-provided secure random to be disabled 2013-12-14 15:17:36 -05:00
Jay Berkenbilt
5e3bad2f86 Refactor random data generation
Add new RandomDataProvider object and implement existing random number
generation in terms of that.  This enables end users to supply their
own random data providers.
2013-12-14 15:17:35 -05:00
Jay Berkenbilt
e9a319fb95 Allow arbitrary whitespace, not just newline, after xref
Fixes #27.
2013-12-14 15:17:23 -05:00
Jay Berkenbilt
478c05fcab Allow -DNO_GET_ENVIRONMENT to avoid GetEnvironmentVariable
If NO_GET_ENVIRONMENT is #defined at compile time on Windows, do not
call GetEnvironmentVariable.  QUtil::get_env will always return
false.  This option is not available through configure.  This was
added to support a specific user's requirements to avoid calling
GetEnvironmentVariable from the Windows API.  Nothing in qpdf outside
the test coverage system in qtest relies on QUtil::get_env.
2013-11-30 15:58:32 -05:00
Jay Berkenbilt
88c29873e5 Add /FS flag (msvc) for parallel builds 2013-11-30 15:58:32 -05:00
Jay Berkenbilt
b75b19589d Add more detail to previous ChangeLog entry 2013-11-30 15:58:32 -05:00
Jay Berkenbilt
dc9df97466 Include <algorithm> for std::min, std::max 2013-11-29 10:48:16 -05:00
Jay Berkenbilt
157c936b97 Use 8 bit per sample images in tests
In compare image tests, use the gs device tiff24nc instead of tiff12nc
since the 4 bit per sample images created by tiff12nc could sometimes
trigger a bug in tiffcmp.  Fixes #20.
2013-11-21 13:41:37 -05:00
Jay Berkenbilt
c1e39381fa Add a ChangeLog note for previous fix 2013-11-21 13:30:58 -05:00
Jay Berkenbilt
e1bd72b46c Prepare for 5.0.1 release 2013-10-18 13:51:30 -04:00
Jay Berkenbilt
a237e92445 Warn when -accessibility=n will be ignored
Also accept -accessibility=n with 256 bit keys even though it will be
ignored.
2013-10-18 10:45:15 -04:00
Jay Berkenbilt
ac9c1f0d56 Security: replace operator[] with at
For std::string and std::vector, replace operator[] with at.  This was
done using an automated process.  See README.hardening for details.
2013-10-18 10:45:14 -04:00
Jay Berkenbilt
4229457068 Security: use a secure random number generator
If not available, give an error.  The user may also configure qpdf to
use an insecure random number generator.
2013-10-18 10:45:12 -04:00
Jay Berkenbilt
e19eb579b2 Replace some assertions with std::logic_error
Ideally, the library should never call assert outside of test code,
but it does in several places.  For some cases where the assertion
might conceivably fail because of a problem with the input data,
replace assertions with exceptions so that they can be trapped by the
calling application.  This commit surely misses some cases and
replaced some cases unnecessarily, but it should still be an
improvement.
2013-10-09 20:57:14 -04:00
Jay Berkenbilt
0bfe902489 Security: avoid pre-allocating vectors based on file data
In places where std::vector<T>(size_t) was used, either validate that
the size parameter is sane or refactor code to avoid the need to
pre-allocate the vector.
2013-10-09 20:57:14 -04:00
Jay Berkenbilt
10bceb552f Security: sanitize /W in xref stream
The /W array was not sanitized, possibly causing an integer overflow
in a multiplication. An analysis of the code suggests that there were
no possible exploits based on this since the problems were in checking
expected values but bounds checks were performed on actual values.
2013-10-09 20:57:07 -04:00
Jay Berkenbilt
3eb4b066ab Security: better bounds checks for linearization data
The faulty code was only used during explicit checks of linearization
data.  Those checks are not part of normal reading or writing of PDF
files.
2013-10-09 19:50:09 -04:00
Jay Berkenbilt
b097d7a81b Security: handle empty name in normalizeName 2013-10-09 19:50:09 -04:00
Jay Berkenbilt
eb1b1264b4 Security: fix potential multiplication overflow
Better sanity check inputs to bit stream reader
2013-10-09 19:50:09 -04:00
Jay Berkenbilt
c2e91d8ec3 Security: keep cur_byte pointing into bytes array 2013-10-09 19:50:07 -04:00
Jay Berkenbilt
66e63b8667 Prepare 5.0.0 release 2013-07-10 12:29:13 -04:00
Jay Berkenbilt
cee2592ed1 Change API/ABI and withdraw 4.2.0
4.2.0 was binary incompatible in spite of there being no deletions or
changes to any public methods.  As such, we have to bump the ABI and
are fixing some API breakage while we're at it.

Previous 4.3.0 target is now 5.1.0.
2013-07-10 11:30:13 -04:00
Jay Berkenbilt
f31e526d67 Prepare 4.2.0 release 2013-07-07 19:43:16 -04:00
Jay Berkenbilt
b84f57e56d Ignore broken DecodeParms for stream with no filters 2013-07-07 19:43:16 -04:00
Jay Berkenbilt
91367239fd Add --show-npages option to qpdf 2013-07-07 19:43:16 -04:00
Jay Berkenbilt
adccedc02f Allow numeric range to be omitted qpdf --pages
Detect a missing page range and assume 1-z.
2013-07-07 19:43:16 -04:00
Jay Berkenbilt
a85007cb0d Handle more broken files
Space rather than newline after xref, missing /ID in trailer for
encrypted file.  This enables qpdf to handle some files that xpdf can
handle.  Adobe reader can't necessarily handle them.
2013-06-15 12:40:01 -04:00
Jay Berkenbilt
16051788ed Handle /Outlines dictionary being a direct object
Even though this case is not valid according to the spec, it has been
seen, and caused an internal error.
2013-06-14 21:36:04 -04:00
Jay Berkenbilt
eae8370cd9 Add optional /Length key in crypt filter dictionary 2013-06-14 20:42:39 -04:00
Jay Berkenbilt
a3576a7359 Bug fix: handle generation > 0 when generating object streams
Rework QPDFWriter to always track old object IDs and QPDFObjGen
instead of int, thus not discarding the generation number.  Switch to
QPDF::getCompressibleObjGen() to properly handle the case of an old
object eligible for compression that has a generation of other than
zero.
2013-06-14 14:58:09 -04:00
Jay Berkenbilt
5039da0b91 Add QPDFObjectHandle::getObjGen()
This is safer than getObjectID() and getGeneration() for many uses.
2013-06-14 14:58:09 -04:00
Jay Berkenbilt
d88231e01e Promote QPDF::ObjGen to top-level object QPDFObjGen 2013-06-14 14:58:08 -04:00
Jay Berkenbilt
f02c5f5e12 Final preparation for 4.1.0 release 2013-04-14 15:03:51 -04:00
Jay Berkenbilt
e8ddac8950 Document casting policy 2013-03-25 14:37:25 -04:00
Jay Berkenbilt
49c7681c58 Windows install: check DLL type
When copying dlls, make sure to only consider DLLs whose type matches
the type of what is loading them.
2013-03-11 14:10:37 -04:00
Jay Berkenbilt
197af341de Use ./install-sh instead of install -c 2013-03-07 11:29:56 -05:00
Jay Berkenbilt
119f2a4b68 Add method to terminate content stream parsing 2013-03-05 13:35:46 -05:00
Jay Berkenbilt
fd64959398 Favor strerror_s and fopen_s on MSVC
Make remaining calls to fopen and strerror use strerror_s and fopen_s
on MSVC.
2013-03-05 13:35:46 -05:00
Jay Berkenbilt
ac4deac187 Call QUtil::safe_fopen in place of fopen
fopen was previuosly called wrapped by QUtil::fopen_wrapper, but
QUtil::safe_fopen does this itself, which is less cumbersome.
2013-03-05 13:35:46 -05:00
Jay Berkenbilt
a51ae10b8d Remove all calls to sprintf 2013-03-05 13:35:46 -05:00
Jay Berkenbilt
8be8277613 Rewrite QUtil::int_to_string and QUtil::double_to_string
Make them safer by avoiding any internal limits and replacing sprintf
with std::ostringstream.
2013-03-04 16:45:16 -05:00
Jay Berkenbilt
a11081085b Handle warning flags better
Make --enable-werror work properly on msvc, handle extra warnings
flags for msvc in configure.ac instead of hardcoding into
make/msvc.mk, separate warnings flags into WFLAGS in autoconf.mk to
avoid duplication and to make it easier to override.
2013-03-04 16:45:15 -05:00
Jay Berkenbilt
32b62035ce Replace many calls to sprintf with QUtil::hex_encode
Add QUtil::hex_encode to encode binary data has a hexadecimal string,
and use it in place of sprintf where possible.
2013-03-04 16:45:15 -05:00
Jay Berkenbilt
6c7bf114dc Bug fix: properly handle overridden compressed objects
When caching objects in an object stream, only cache objects that
still resolve to that stream.  See Changelog mod from this commit for
details.
2013-02-23 17:51:17 -05:00
Jay Berkenbilt
7e7c93951f Do not remove libqpdf.la
Some distributions (like debian) don't want .la files to be installed,
but the responsibility for doing this should like in the packaging,
not in qpdf itself.
2013-01-31 16:16:45 -05:00
Jay Berkenbilt
a5d8783f67 Improve qpdf --check
Fix exit status for case of errors without warnings, continue after
errors when possible, add test case for parsing a file with content
stream errors on some but not all pages.
2013-01-25 11:08:50 -05:00
Jay Berkenbilt
a7e8b8c789 Have qpdf --check parse content streams
Also move writing to null and parsing of content streams out of the
wrong if block.
2013-01-24 11:47:36 -05:00
Jay Berkenbilt
bfda717749 Cosmetic changes to be closer to Adobe terminology
Change object type Keyword to Operator, and place the order of the
object types in object_type_e in the same order as they are mentioned
in the PDF specification.

Note that this change only breaks backward compatibility with code
that has not yet been released.
2013-01-23 09:38:05 -05:00
Jay Berkenbilt
913eb5ac35 Add getTypeCode() and getTypeName()
Add virtual methods to QPDFObject, wrappers to QPDFObjectHandle, and
implementations to all the QPDF_Object types.
2013-01-22 10:01:45 -05:00
Jay Berkenbilt
f81152311e Add QPDFObjectHandle::parseContentStream method
This method allows parsing of the PDF objects in a content stream or
array of content streams.
2013-01-20 15:35:39 -05:00
Jay Berkenbilt
1d88955fa6 Added new QPDFObjectHandle types Keyword and InlineImage
These object types are to facilitate content stream parsing.
2013-01-20 15:35:39 -05:00
Jay Berkenbilt
8708fd373d Prepare 4.0.1 release 2013-01-17 09:51:04 -05:00
Jay Berkenbilt
0e9949afde Update versions for 4.0.0 release 2012-12-31 11:43:27 -05:00
Jay Berkenbilt
f8306913ba Update "C" API with functions for new features 2012-12-31 10:32:32 -05:00
Jay Berkenbilt
ae1385cd8a Update ChangeLog with recent changes 2012-12-31 10:32:32 -05:00
Jay Berkenbilt
04c203ae06 Eliminate flattenScalarReferences 2012-12-31 05:36:48 -05:00
Jay Berkenbilt
7f84239cad Find PDF header anywhere in the first 1024 bytes 2012-12-25 14:43:37 -05:00
Jay Berkenbilt
739a78e200 Add Requires.private to libqpdf.pc for static linking 2012-11-20 13:57:37 -05:00
Jay Berkenbilt
f256670eba Ignore objects with offset 0 2012-11-20 13:57:37 -05:00
Jay Berkenbilt
041397fdab Allow reading from InputSource and writing to Pipeline
Allowing users to subclass InputSource and Pipeline to read and write
from/to arbitrary sources provides the maximum flexibility for users
who want to read and write from other than files or memory.
2012-09-23 17:42:26 -04:00