OpenSystemsDevelopment / qpdf

Commit 724658fe65ed424e817c9fcc789a879aa67ebbe2

Authored by m-holger
Committed by GitHub
2 parents 5303b253 aef09904

Merge pull request #1600 from m-holger/fuzz 

Enhance validation of xref entries for deleted objects.
Inline Side-by-side
Showing 4 changed files with 6 additions and 3 deletions
fuzz/CMakeLists.txt
  View file @724658f
@@ -162,6 +162,7 @@ set(CORPUS_OTHER @@ -162,6 +162,7 @@ set(CORPUS_OTHER
162 440599107.fuzz 162 440599107.fuzz
163 440747125.fuzz 163 440747125.fuzz
164 4720043549327360.fuzz 164 4720043549327360.fuzz
  165 + 4797504999981056.fuzz
165 4876793183272960.fuzz 166 4876793183272960.fuzz
166 5109284021272576.fuzz 167 5109284021272576.fuzz
167 5344352869351424.fuzz 168 5344352869351424.fuzz
fuzz/qpdf_extra/4797504999981056.fuzz 0 → 100644
  View file @724658f
  1 + xref 2147483647 1 1 5 fstartxref 2
  2 +trailer<</Size 1>>
0 \ No newline at end of file 3 \ No newline at end of file
fuzz/qtest/fuzz.test
  View file @724658f
@@ -11,7 +11,7 @@ my $td = new TestDriver(&#39;fuzz&#39;); @@ -11,7 +11,7 @@ my $td = new TestDriver(&#39;fuzz&#39;);
11 11
12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS"; 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13
14 -my $n_qpdf_files = 106; # increment when adding new files 14 +my $n_qpdf_files = 107; # increment when adding new files
15 15
16 my @fuzzers = ( 16 my @fuzzers = (
17 ['ascii85' => 1], 17 ['ascii85' => 1],
libqpdf/QPDF_objects.cc
  View file @724658f
@@ -533,7 +533,7 @@ Objects::read_xref(qpdf_offset_t xref_offset, bool in_stream_recovery) @@ -533,7 +533,7 @@ Objects::read_xref(qpdf_offset_t xref_offset, bool in_stream_recovery)
533 max_obj = std::max(max_obj, *(m->deleted_objects.rbegin())); 533 max_obj = std::max(max_obj, *(m->deleted_objects.rbegin()));
534 } 534 }
535 if (size < 1 || (size - 1) != max_obj) { 535 if (size < 1 || (size - 1) != max_obj) {
536 - if (size == (max_obj + 2) && qpdf.getObject(max_obj +1, 0).isStreamOfType("/XRef")) { 536 + if (size == (max_obj + 2) && qpdf.getObject(max_obj + 1, 0).isStreamOfType("/XRef")) {
537 warn(damagedPDF( 537 warn(damagedPDF(
538 "", 538 "",
539 -1, 539 -1,
@@ -1132,7 +1132,7 @@ Objects::insertXrefEntry(int obj, int f0, qpdf_offset_t f1, int f2) @@ -1132,7 +1132,7 @@ Objects::insertXrefEntry(int obj, int f0, qpdf_offset_t f1, int f2)
1132 void 1132 void
1133 Objects::insertFreeXrefEntry(QPDFObjGen og) 1133 Objects::insertFreeXrefEntry(QPDFObjGen og)
1134 { 1134 {
1135 - if (!m->xref_table.contains(og)) { 1135 + if (!m->xref_table.contains(og) && og.getObj() <= m->xref_table_max_id) {
1136 m->deleted_objects.insert(og.getObj()); 1136 m->deleted_objects.insert(og.getObj());
1137 } 1137 }
1138 } 1138 }