OpenSystemsDevelopment / qpdf

Commit 800e89de583c45d8c116133bbfc2e7cf52942d49

Authored by m-holger
Committed by GitHub
2 parents 059d9a9b bdeb1036

Merge pull request #1527 from m-holger/fuzz 

Improve null key/value handling in `NNTree`, add checks across insert…
Inline Side-by-side
Showing 1 changed file with 9 additions and 5 deletions
libqpdf/NNTree.cc
  View file @800e89d
... ... @@ -106,7 +106,7 @@ NNTreeIterator::getNextKid(PathElement& pe, bool backward)
106 106 bool
107 107 NNTreeIterator::valid() const
108 108 {
109   - return item_number >= 0;
  109 + return item_number >= 0 && ivalue.first && ivalue.second;
110 110 }
111 111  
112 112 void
... ... @@ -381,6 +381,9 @@ NNTreeIterator::insertAfter(QPDFObjectHandle const& key, QPDFObjectHandle const&
381 381 if (std::cmp_less(items.size(), item_number + 2)) {
382 382 impl.error(node, "insert: items array is too short");
383 383 }
  384 + if (!(key && value)) {
  385 + impl.error(node, "insert: key or value is null");
  386 + }
384 387 items.insert(item_number + 2, key);
385 388 items.insert(item_number + 3, value);
386 389 resetLimits(node, lastPathElement());
... ... @@ -737,11 +740,9 @@ NNTreeImpl::repair()
737 740 new_node.replaceKey(details.itemsKey(), Array());
738 741 NNTreeImpl repl(details, qpdf, new_node, false);
739 742 for (auto const& [key, value]: *this) {
740   -// if (key && value) {
  743 + if (key && value) {
741 744 repl.insert(key, value);
742   -// } else {
743   -// std::cerr << key.unparse() << "\n";
744   -// }
  745 + }
745 746 }
746 747 oh.replaceKey("/Kids", new_node.getKey("/Kids"));
747 748 oh.replaceKey(details.itemsKey(), new_node.getKey(details.itemsKey()));
... ... @@ -824,6 +825,9 @@ NNTreeImpl::insertFirst(QPDFObjectHandle const&amp; key, QPDFObjectHandle const&amp; val
824 825 if (!items) {
825 826 error(oh, "unable to find a valid items node");
826 827 }
  828 + if (!(key && value)) {
  829 + error(oh, "unable to insert null key or value");
  830 + }
827 831 items.insert(0, key);
828 832 items.insert(1, value);
829 833 iter.setItemNumber(iter.node, 0);
... ...