diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt index 288c168..37c8f48 100644 --- a/fuzz/CMakeLists.txt +++ b/fuzz/CMakeLists.txt @@ -157,6 +157,7 @@ set(CORPUS_OTHER 394463491.fuzz 398060137.fuzz 409905355.fuzz + 411312393.fuzz ) set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) diff --git a/fuzz/qpdf_extra/411312393.fuzz b/fuzz/qpdf_extra/411312393.fuzz new file mode 100644 index 0000000..3c0e265 --- /dev/null +++ b/fuzz/qpdf_extra/411312393.fuzz diff --git a/fuzz/qtest/fuzz.test b/fuzz/qtest/fuzz.test index 12229d0..f29a798 100644 --- a/fuzz/qtest/fuzz.test +++ b/fuzz/qtest/fuzz.test @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz'); my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS"; -my $n_qpdf_files = 94; # increment when adding new files +my $n_qpdf_files = 95; # increment when adding new files my @fuzzers = ( ['ascii85' => 1], diff --git a/libqpdf/QPDF_pages.cc b/libqpdf/QPDF_pages.cc index 749533f..6fc2b4d 100644 --- a/libqpdf/QPDF_pages.cc +++ b/libqpdf/QPDF_pages.cc @@ -109,6 +109,14 @@ QPDF::getAllPagesInternal( QTC::TC("qpdf", "QPDF inherit mediabox", media_box ? 0 : 1); } auto kids = cur_node.getKey("/Kids"); + if (!visited.add(kids)) { + throw QPDFExc( + qpdf_e_pages, + m->file->getName(), + "object " + cur_node.getObjGen().unparse(' '), + 0, + "Loop detected in /Pages structure (getAllPages)"); + } int i = -1; for (auto& kid: kids.as_array()) { ++i;