diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt index 020dd05..89cfd81 100644 --- a/fuzz/CMakeLists.txt +++ b/fuzz/CMakeLists.txt @@ -140,6 +140,7 @@ set(CORPUS_OTHER 70306.fuzz 70306a.fuzz 70306b.fuzz + 71624.fuzz ) set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) diff --git a/fuzz/qpdf_extra/71624.fuzz b/fuzz/qpdf_extra/71624.fuzz new file mode 100644 index 0000000..ffb776d --- /dev/null +++ b/fuzz/qpdf_extra/71624.fuzz diff --git a/fuzz/qtest/fuzz.test b/fuzz/qtest/fuzz.test index aad72e1..eebc3c1 100644 --- a/fuzz/qtest/fuzz.test +++ b/fuzz/qtest/fuzz.test @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz'); my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS"; -my $n_qpdf_files = 77; # increment when adding new files +my $n_qpdf_files = 78; # increment when adding new files my @fuzzers = ( ['ascii85' => 1], diff --git a/include/qpdf/QPDF.hh b/include/qpdf/QPDF.hh index 6e56756..c0c3353 100644 --- a/include/qpdf/QPDF.hh +++ b/include/qpdf/QPDF.hh @@ -676,7 +676,7 @@ class QPDF // Traverse page tree return all /Page objects. It also detects and resolves cases in which the // same /Page object is duplicated. For efficiency, this method returns a const reference to an // internal vector of pages. Calls to addPage, addPageAt, and removePage safely update this, but - // directly manipulation of the pages tree or pushing inheritable objects to the page level may + // direct manipulation of the pages tree or pushing inheritable objects to the page level may // invalidate it. See comments for updateAllPagesCache() for additional notes. Newer code should // use QPDFPageDocumentHelper::getAllPages instead. The decision to expose this internal cache // was arguably incorrect, but it is being left here for compatibility. It is, however, diff --git a/libqpdf/QPDF_pages.cc b/libqpdf/QPDF_pages.cc index 0c8f382..195421c 100644 --- a/libqpdf/QPDF_pages.cc +++ b/libqpdf/QPDF_pages.cc @@ -71,7 +71,13 @@ QPDF::getAllPages() throw QPDFExc( qpdf_e_pages, m->file->getName(), "", 0, "root of pages tree has no /Kids array"); } - getAllPagesInternal(pages, visited, seen, false); + try { + getAllPagesInternal(pages, visited, seen, false); + } catch (...) { + m->all_pages.clear(); + m->invalid_page_found = false; + throw; + } if (m->invalid_page_found) { flattenPagesTree(); m->invalid_page_found = false;