OpenSystemsDevelopment / qpdf

Commit 85f05cc57ffa0a863d9d9b23e73acea9410b2937

Authored by Jay Berkenbilt
1 parent 2d0c6873

Detect xref pointer infinite loop (fixes #149)

Inline Side-by-side
Showing 5 changed files with 134 additions and 0 deletions
ChangeLog
  View file @85f05cc
  1 +2017-08-25 Jay Berkenbilt <ejb@ql.org>
  2 +
  3 + * Detect infinite loop while finding additional xref tables. Fixes
  4 + #149.
  5 +
1 2017-08-22 Jay Berkenbilt <ejb@ql.org> 6 2017-08-22 Jay Berkenbilt <ejb@ql.org>
2 7
3 * 7.0.b1: release 8 * 7.0.b1: release
libqpdf/QPDF.cc
  View file @85f05cc
@@ -491,8 +491,10 @@ void @@ -491,8 +491,10 @@ void
491 QPDF::read_xref(qpdf_offset_t xref_offset) 491 QPDF::read_xref(qpdf_offset_t xref_offset)
492 { 492 {
493 std::map<int, int> free_table; 493 std::map<int, int> free_table;
  494 + std::set<qpdf_offset_t> visited;
494 while (xref_offset) 495 while (xref_offset)
495 { 496 {
  497 + visited.insert(xref_offset);
496 char buf[7]; 498 char buf[7];
497 memset(buf, 0, sizeof(buf)); 499 memset(buf, 0, sizeof(buf));
498 this->m->file->seek(xref_offset, SEEK_SET); 500 this->m->file->seek(xref_offset, SEEK_SET);
@@ -520,6 +522,10 @@ QPDF::read_xref(qpdf_offset_t xref_offset) @@ -520,6 +522,10 @@ QPDF::read_xref(qpdf_offset_t xref_offset)
520 { 522 {
521 xref_offset = read_xrefStream(xref_offset); 523 xref_offset = read_xrefStream(xref_offset);
522 } 524 }
  525 + if (visited.count(xref_offset) != 0)
  526 + {
  527 + xref_offset = 0;
  528 + }
523 } 529 }
524 530
525 if (! this->m->trailer.isInitialized()) 531 if (! this->m->trailer.isInitialized())
qpdf/qtest/qpdf.test
  View file @85f05cc
@@ -221,6 +221,7 @@ my @bug_tests = ( @@ -221,6 +221,7 @@ my @bug_tests = (
221 ["141a", "/W entry size 0", 2], 221 ["141a", "/W entry size 0", 2],
222 ["141b", "/W entry size 0", 2], 222 ["141b", "/W entry size 0", 2],
223 ["143", "self-referential ostream", 3], 223 ["143", "self-referential ostream", 3],
  224 + ["149", "xref prev pointer loop", 3],
224 ); 225 );
225 $n_tests += scalar(@bug_tests); 226 $n_tests += scalar(@bug_tests);
226 foreach my $d (@bug_tests) 227 foreach my $d (@bug_tests)
qpdf/qtest/qpdf/issue-149.out 0 → 100644
  View file @85f05cc
  1 +WARNING: issue-149.pdf: reported number of objects (11) inconsistent with actual number of objects (7)
  2 +qpdf: operation succeeded with warnings; resulting file may have some problems
qpdf/qtest/qpdf/issue-149.pdf 0 → 100644
  View file @85f05cc
  1 +%PDF-1.7
  2 +%Á∑·∂
  3 +% vim: set tw=76 ts=2 et :
  4 +% convert with:
  5 +% ./fixlengths < hello.txt > hello.pdf ; ./genxref hello.pdf
  6 +1 0 obj
  7 + << /Type /Catalog
  8 + /Outlines 6 0 R
  9 + /Pages 2 0 R
  10 + >>
  11 +endobj
  12 +
  13 +2 0 obj
  14 + << /Type /Pages
  15 + /Kids [3 0 R]
  16 + /Count 1
  17 + >>
  18 +endobj
  19 +
  20 +3 0 obj
  21 + << /Type /Page
  22 + /Parent 2 0 R
  23 + /MediaBox [0 0 595.276 841.89]
  24 + /Contents 4 0 R
  25 + /Resources <<
  26 + /ProcSet [/PDF /Text]
  27 + /Font << /F1 5 0 R >>
  28 + >>
  29 + >>
  30 +endobj
  31 +
  32 +4 0 obj
  33 + << /Length 36 >>
  34 +stream
  35 + BT 80 100 Td /F1 48 Tf (foo) Tj ET
  36 +endstream
  37 +endobj
  38 +
  39 +5 0 obj
  40 + << /Type /Font
  41 + /Subtype /Type1
  42 + /Name /F1
  43 + /BaseFont /Helvetica
  44 + /Encoding /MacRomanEncoding
  45 + >>
  46 +endobj
  47 +
  48 +6 0 obj
  49 + << /Type /Outlines
  50 + /Count 0
  51 + >>
  52 +endobj
  53 +
  54 +xref
  55 +0 7
  56 +0000000000 65535 f
  57 +0000000125 00000 n
  58 +0000000208 00000 n
  59 +0000000283 00000 n
  60 +0000000492 00000 n
  61 +0000000583 00000 n
  62 +0000000721 00000 n
  63 +
  64 +trailer
  65 + << /Size 7
  66 + /Prev 1516
  67 + /Root 1 0 R
  68 + >>
  69 +startxref
  70 +779%%EOF
  71 +
  72 +% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  73 +1 1 obj
  74 + << /Type /Catalog
  75 + /Outlines 6 0 R
  76 + /Pages 2 1 R
  77 + >>
  78 +endobj
  79 +
  80 +2 1 obj
  81 + << /Type /Pages
  82 + /Kids [3 1 R]
  83 + /Count 1
  84 + >>
  85 +endobj
  86 +
  87 +3 1 obj
  88 + << /Type /Page
  89 + /Parent 2 1 R
  90 + /MediaBox [0 0 595.276 841.89]
  91 + /Contents 4 1 R
  92 + /Resources <<
  93 + /ProcSet [/PDF /Text]
  94 + /Font << /F1 5 0 R >>
  95 + >>
  96 + >>
  97 +endobj
  98 +
  99 +4 1 obj
  100 + << /Length 36 >>
  101 +stream
  102 + BT 80 100 Td /F1 48 Tf (bar) Tj ET
  103 +endstream
  104 +endobj
  105 +
  106 +xref
  107 +1 4
  108 +0000001058 00001 n
  109 +0000001141 00001 n
  110 +0000001216 00001 n
  111 +0000001425 00001 n
  112 +
  113 +trailer
  114 + << /Size 11
  115 + /Prev 779
  116 + /Root 1 1 R
  117 + >>
  118 +startxref
  119 +1516
  120 +%%EOF