Add sanity check for xref stream /Size entry

m-holger
1 parent 529501aa
Showing 1 changed file with 3 additions and 0 deletions
libqpdf/QPDF.cc
@@ -1295,6 +1295,9 @@ QPDF::Xref_table::process_stream(qpdf_offset_t xref_offset, QPDFObjectHandle&amp; xr
     if (!trailer_) {
         trailer_ = dict;
+        if (size > toS(max_id_)) {
+            throw damaged("Cross-reference stream /Size entry is impossibly large");
+        }
         table.resize(size);
     }