diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index ce5038e..12b23a8 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -2064,6 +2064,7 @@ QPDF::resolveObjectsInStream(int obj_stream_number) (m->file->getName() + " object stream " + std::to_string(obj_stream_number)), bp.get())); + qpdf_offset_t last_offset = -1; for (int i = 0; i < n; ++i) { QPDFTokenizer::Token tnum = readToken(*input); QPDFTokenizer::Token toffset = readToken(*input); @@ -2089,6 +2090,15 @@ QPDF::resolveObjectsInStream(int obj_stream_number) "object stream claims to contain itself")); continue; } + if (offset <= last_offset) { + throw damagedPDF( + *input, + m->last_object_description, + input->getLastOffset(), + "expected offsets in object stream to be increasing"); + } + last_offset = offset; + offsets[num] = toI(offset + first); }