Merge pull request #1294 from m-holger/fuzz

Add additional xref and object stream sanity checks

Merge pull request #1294 from m-holger/fuzz
Add additional xref and object stream sanity checks
m-holger · GitHub
2 parents 529501aa c2ff89ae
Showing 6 changed files with 17 additions and 1 deletions
fuzz/CMakeLists.txt
fuzz/qpdf_extra/369662293.fuzz
fuzz/qpdf_extra/369662293a.fuzz
fuzz/qpdf_extra/99999e.fuzz
fuzz/qtest/fuzz.test
libqpdf/QPDF.cc
@@ -146,6 +146,9 @@ set(CORPUS_OTHER
   99999b.fuzz
   99999c.fuzz
   99999d.fuzz
+  99999e.fuzz
+  369662293.fuzz
+  369662293a.fuzz
 )
 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
@@ -11,7 +11,7 @@ my $td = new TestDriver(&#39;fuzz&#39;);
 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
-my $n_qpdf_files = 83;       # increment when adding new files
+my $n_qpdf_files = 86;       # increment when adding new files
 my @fuzzers = (
     ['ascii85' => 1],
@@ -1295,6 +1295,9 @@ QPDF::Xref_table::process_stream(qpdf_offset_t xref_offset, QPDFObjectHandle&amp; xr
     if (!trailer_) {
         trailer_ = dict;
+        if (size > toS(max_id_)) {
+            throw damaged("Cross-reference stream /Size entry is impossibly large");
+        }
         table.resize(size);
     }
@@ -2061,6 +2064,7 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
             (m->file->getName() + " object stream " + std::to_string(obj_stream_number)),
             bp.get()));
+    qpdf_offset_t last_offset = -1;
     for (int i = 0; i < n; ++i) {
         QPDFTokenizer::Token tnum = readToken(*input);
         QPDFTokenizer::Token toffset = readToken(*input);
@@ -2086,6 +2090,15 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
                 "object stream claims to contain itself"));
             continue;
         }
+        if (offset <= last_offset) {
+            throw damagedPDF(
+                *input,
+                m->last_object_description,
+                input->getLastOffset(),
+                "expected offsets in object stream to be increasing");
+        }
+        last_offset = offset;
+
         offsets[num] = toI(offset + first);
     }