Fix infinite loop while reporting an error (fixes #101)

This is CVE-2017-9210. The description string for an error message included unparsing an object, which is too complex of a thing to try to do while throwing an exception. There was only one example of this in the entire codebase, so it is not a pervasive problem. Fixing this eliminated one class of infinite loop errors.

Fix infinite loop while reporting an error (fixes #101)
This is CVE-2017-9210. The description string for an error message included unparsing an object, which is too complex of a thing to try to do while throwing an exception. There was only one example of this in the entire codebase, so it is not a pervasive problem. Fixing this eliminated one class of infinite loop errors.
Jay Berkenbilt
1 parent bd6c8456
Showing 5 changed files with 27 additions and 3 deletions
ChangeLog
libqpdf/QPDFObjectHandle.cc
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/issue-101.out
qpdf/qtest/qpdf/issue-101.pdf
+2017-07-26  Jay Berkenbilt  <ejb@ql.org>
+
+	* CVE-2017-9210: Fix infinite loop caused by attempting to unparse
+	an object for inclusion in the text of an exception.
+
 2015-11-10  Jay Berkenbilt  <ejb@ql.org>
 	* 6.0.0: release
@@ -1076,8 +1076,7 @@ QPDFObjectHandle::parseInternal(PointerHolder&lt;InputSource&gt; input,
 		throw QPDFExc(
 		    qpdf_e_damaged_pdf,
 		    input->getName(), object_description, offset,
-		    std::string("dictionary key not name (") +
-		    key_obj.unparse() + ")");
+		    std::string("dictionary key is not not a name token"));
 	    }
 	    dict[key_obj.getName()] = val;
 	}
@@ -206,7 +206,7 @@ $td-&gt;runtest(&quot;remove page we don&#39;t have&quot;,
 show_ntests();
 # ----------
 $td->notify("--- Miscellaneous Tests ---");
-$n_tests += 77;
+$n_tests += 78;
 $td->runtest("qpdf version",
 	     {$td->COMMAND => "qpdf --version"},
@@ -218,6 +218,20 @@ $td-&gt;runtest(&quot;C API: qpdf version&quot;,
 	      $td->EXIT_STATUS => 0},
 	     $td->NORMALIZE_NEWLINES);
+# Files to reproduce various bugs
+foreach my $d (
+    ["101", "resolve for exception text"],
+    )
+{
+    my ($n, $description) = @$d;
+    $td->runtest($description,
+                 {$td->COMMAND => "qpdf issue-$n.pdf a.pdf"},
+                 {$td->FILE => "issue-$n.out",
+                  $td->EXIT_STATUS => 2},
+                 $td->NORMALIZE_NEWLINES);
+}
+
+
 foreach (my $i = 1; $i <= 3; ++$i)
 {
     $td->runtest("misc tests",
+WARNING: issue-101.pdf: file is damaged
+WARNING: issue-101.pdf (file position 3526): xref not found
+WARNING: issue-101.pdf: Attempting to reconstruct cross-reference table
+WARNING: issue-101.pdf (object 5 0, file position 1509): attempting to recover stream length
+WARNING: issue-101.pdf (object 5 0, file position 2097): attempting to recover stream length
+issue-101.pdf (trailer, file position 2928): unknown token while reading object (ÿ)