Pad encryption parameters that are too short (fixes #96)

Jay Berkenbilt
1 parent 0c99cf87
Showing 6 changed files with 93 additions and 1 deletions
ChangeLog
libqpdf/QPDF_encryption.cc
qpdf/qpdf.testcov
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/short-O-U.out
qpdf/qtest/qpdf/short-O-U.pdf
+2017-08-11  Jay Berkenbilt  <ejb@ql.org>
+
+	* Handle encrypted files whose encryption parameters are too
+	short. Fixes #96.
+
 2017-08-10  Jay Berkenbilt  <ejb@ql.org>
 	* Remove dependency on libpcre.
@@ -340,6 +340,16 @@ hash_V5(std::string const&amp; password,
     return result;
 }
+static
+void pad_short_parameter(std::string& param, unsigned int max_len)
+{
+    if (param.length() < max_len)
+    {
+        QTC::TC("qpdf", "QPDF_encryption pad short parameter");
+        param.append(max_len - param.length(), '\0');
+    }
+}
+
 std::string
 QPDF::compute_data_key(std::string const& encryption_key,
 		       int objid, int generation, bool use_aes,
@@ -876,6 +886,8 @@ QPDF::initializeEncryption()
     if (V < 5)
     {
+        pad_short_parameter(O, key_bytes);
+        pad_short_parameter(U, key_bytes);
         if (! ((O.length() == key_bytes) && (U.length() == key_bytes)))
         {
             throw QPDFExc(qpdf_e_damaged_pdf, this->file->getName(),
@@ -899,6 +911,11 @@ QPDF::initializeEncryption()
         UE = encryption_dict.getKey("/UE").getStringValue();
         Perms = encryption_dict.getKey("/Perms").getStringValue();
+        pad_short_parameter(O, OU_key_bytes_V5);
+        pad_short_parameter(U, OU_key_bytes_V5);
+        pad_short_parameter(OE, OUE_key_bytes_V5);
+        pad_short_parameter(UE, OUE_key_bytes_V5);
+        pad_short_parameter(Perms, Perms_key_bytes_V5);
         if ((O.length() < OU_key_bytes_V5) ||
             (U.length() < OU_key_bytes_V5) ||
             (OE.length() < OUE_key_bytes_V5) ||
@@ -293,3 +293,4 @@ QPDF ignore first space in xref entry 0
 QPDF ignore first extra space in xref entry 0
 QPDF ignore second extra space in xref entry 0
 QPDF ignore length error xref entry 0
+QPDF_encryption pad short parameter 0
@@ -232,7 +232,7 @@ foreach my $d (@bug_tests)
 show_ntests();
 # ----------
 $td->notify("--- Miscellaneous Tests ---");
-$n_tests += 87;
+$n_tests += 88;
 $td->runtest("qpdf version",
 	     {$td->COMMAND => "qpdf --version"},
@@ -676,6 +676,16 @@ $td-&gt;runtest(&quot;recoverable xref errors&quot;,
               $td->EXIT_STATUS => 3},
              $td->NORMALIZE_NEWLINES);
+# A file was emailed privately with issue 96. short-O-U.pdf was
+# created by copying encryption parameters from that file. It exhibits
+# the same behavior as the original file.
+$td->runtest("short /O or /U",
+             {$td->COMMAND =>
+                  "qpdf --password=19723102477 --check short-O-U.pdf"},
+             {$td->FILE => "short-O-U.out",
+              $td->EXIT_STATUS => 0},
+             $td->NORMALIZE_NEWLINES);
+
 show_ntests();
 # ----------
 $td->notify("--- Single Page ---");
+checking short-O-U.pdf
+PDF Version: 1.6
+R = 4
+P = -4
+User password = 19723102477
+extract for accessibility: allowed
+extract for any purpose: allowed
+print low resolution: allowed
+print high resolution: allowed
+modify document assembly: allowed
+modify forms: allowed
+modify annotations: allowed
+modify other: allowed
+modify anything: allowed
+stream encryption method: AESv2
+string encryption method: AESv2
+file encryption method: AESv2
+File is not linearized
+No syntax or stream encoding errors found; the file may still contain
+errors that qpdf cannot detect