Fix loop in QPDFOutlineDocumentHelper (fuzz issue 30507)

Jay Berkenbilt
1 parent 4d1f2fdc
Showing 3 changed files with 10 additions and 0 deletions
ChangeLog
fuzz/qpdf_extra/30507.fuzz
libqpdf/QPDFOutlineDocumentHelper.cc
 2021-02-10  Jay Berkenbilt  <ejb@ql.org>
+	* Detect loops when adding when reading outlines dictionary upon
+	initialization of QPDFOutlineDocumentHelper (fuzz issue 30507).
+
 	* Add "attachments" as an additional json key, and add some
 	information about attachments to the json output.
@@ -24,8 +24,15 @@ QPDFOutlineDocumentHelper::QPDFOutlineDocumentHelper(QPDF&amp; qpdf) :
         return;
     }
     QPDFObjectHandle cur = outlines.getKey("/First");
+    std::set<QPDFObjGen> seen;
     while (! cur.isNull())
     {
+        auto og = cur.getObjGen();
+        if (seen.count(og))
+        {
+            break;
+        }
+        seen.insert(og);
         this->m->outlines.push_back(
             QPDFOutlineObjectHelper::Accessor::create(cur, *this, 1));
         cur = cur.getKey("/Next");