From 9fcf61b2f6e9f6670c5ef7103242b4640712dd4f Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Wed, 10 Feb 2021 16:26:32 -0500 Subject: [PATCH] Fix loop in QPDFOutlineDocumentHelper (fuzz issue 30507) --- ChangeLog | 3 +++ fuzz/qpdf_extra/30507.fuzz | Bin 0 -> 9548 bytes libqpdf/QPDFOutlineDocumentHelper.cc | 7 +++++++ 3 files changed, 10 insertions(+), 0 deletions(-) create mode 100644 fuzz/qpdf_extra/30507.fuzz diff --git a/ChangeLog b/ChangeLog index f587b96..2146f9e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2021-02-10 Jay Berkenbilt + * Detect loops when adding when reading outlines dictionary upon + initialization of QPDFOutlineDocumentHelper (fuzz issue 30507). + * Add "attachments" as an additional json key, and add some information about attachments to the json output. diff --git a/fuzz/qpdf_extra/30507.fuzz b/fuzz/qpdf_extra/30507.fuzz new file mode 100644 index 0000000..e8c28d0 Binary files /dev/null and b/fuzz/qpdf_extra/30507.fuzz differ diff --git a/libqpdf/QPDFOutlineDocumentHelper.cc b/libqpdf/QPDFOutlineDocumentHelper.cc index 85aff76..b5b82a2 100644 --- a/libqpdf/QPDFOutlineDocumentHelper.cc +++ b/libqpdf/QPDFOutlineDocumentHelper.cc @@ -24,8 +24,15 @@ QPDFOutlineDocumentHelper::QPDFOutlineDocumentHelper(QPDF& qpdf) : return; } QPDFObjectHandle cur = outlines.getKey("/First"); + std::set seen; while (! cur.isNull()) { + auto og = cur.getObjGen(); + if (seen.count(og)) + { + break; + } + seen.insert(og); this->m->outlines.push_back( QPDFOutlineObjectHelper::Accessor::create(cur, *this, 1)); cur = cur.getKey("/Next"); -- libgit2 0.21.4