OpenSystemsDevelopment / qpdf

Commit 153060a0c5e92acfda7982dfa62543ef67973cc8

Authored by Dean Scarff
Committed by Jay Berkenbilt
1 parent 9a3791c5

Check integer overflow in resolveObjectsInStream 

Fixes a crash found by fuzzing.
Inline Side-by-side
Showing 1 changed file with 2 additions and 2 deletions
libqpdf/QPDF.cc
  View file @153060a
... ... @@ -2151,8 +2151,8 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
2151 2151 }
2152 2152  
2153 2153 int num = QUtil::string_to_int(tnum.getValue().c_str());
2154   - int offset = QUtil::string_to_int(toffset.getValue().c_str());
2155   - offsets[num] = offset + first;
  2154 + long long offset = QUtil::string_to_int(toffset.getValue().c_str());
  2155 + offsets[num] = QIntC::to_int(offset + first);
2156 2156 }
2157 2157  
2158 2158 // To avoid having to read the object stream multiple times, store
... ...