OpenSystemsDevelopment / qpdf

Commit 7d34b89a69e8e89c098dd373442f7df809c28eff

Authored by m-holger
Committed by GitHub
2 parents ff2a78f5 06a2d955

Merge pull request #1288 from m-holger/fuzz 

In  QPDFParser add a limit on total number of errors in one object
Inline Side-by-side
Showing 2 changed files with 11 additions and 8 deletions
libqpdf/QPDFParser.cc
  View file @7d34b89
@@ -469,13 +469,14 @@ QPDFParser::fixMissingKeys() @@ -469,13 +469,14 @@ QPDFParser::fixMissingKeys()
469 bool 469 bool
470 QPDFParser::tooManyBadTokens() 470 QPDFParser::tooManyBadTokens()
471 { 471 {
472 - if (good_count <= 4) {  
473 - if (++bad_count > 5) {  
474 - warn("too many errors; giving up on reading object");  
475 - return true;  
476 - }  
477 - } else { 472 + if (--max_bad_count > 0 && good_count > 4) {
  473 + good_count = 0;
478 bad_count = 1; 474 bad_count = 1;
  475 + return false;
  476 + }
  477 + if (++bad_count > 5) {
  478 + warn("too many errors; giving up on reading object");
  479 + return true;
479 } 480 }
480 good_count = 0; 481 good_count = 0;
481 return false; 482 return false;
libqpdf/qpdf/QPDFParser.hh
  View file @7d34b89
@@ -83,9 +83,11 @@ class QPDFParser @@ -83,9 +83,11 @@ class QPDFParser
83 std::vector<StackFrame> stack; 83 std::vector<StackFrame> stack;
84 StackFrame* frame; 84 StackFrame* frame;
85 // Number of recent bad tokens. 85 // Number of recent bad tokens.
86 - int bad_count = 0; 86 + int bad_count{0};
  87 + // Number of bad tokens (remaining) before giving up.
  88 + int max_bad_count{15};
87 // Number of good tokens since last bad token. Irrelevant if bad_count == 0. 89 // Number of good tokens since last bad token. Irrelevant if bad_count == 0.
88 - int good_count = 0; 90 + int good_count{0};
89 // Start offset including any leading whitespace. 91 // Start offset including any leading whitespace.
90 qpdf_offset_t start; 92 qpdf_offset_t start;
91 // Number of successive integer tokens. 93 // Number of successive integer tokens.