Validate that offsets in object streams are strictly increasing

m-holger
1 parent 1b6a504d
Showing 1 changed file with 10 additions and 0 deletions
libqpdf/QPDF.cc
@@ -2064,6 +2064,7 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
             (m->file->getName() + " object stream " + std::to_string(obj_stream_number)),
             bp.get()));
+    qpdf_offset_t last_offset = -1;
     for (int i = 0; i < n; ++i) {
         QPDFTokenizer::Token tnum = readToken(*input);
         QPDFTokenizer::Token toffset = readToken(*input);
@@ -2089,6 +2090,15 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
                 "object stream claims to contain itself"));
             continue;
         }
+        if (offset <= last_offset) {
+            throw damagedPDF(
+                *input,
+                m->last_object_description,
+                input->getLastOffset(),
+                "expected offsets in object stream to be increasing");
+        }
+        last_offset = offset;
+
         offsets[num] = toI(offset + first);
     }