OpenSystemsDevelopment / qpdf

Commit a078265671c5479494f7690df1f2eb0faccbdf0f

Authored by m-holger
1 parent ac94437a

Detect shared /Kids arrays in pages tree 

In QPDF::getAllPagesInternal include the /Kids array in the visited set
for loop detection.

Fixes oss-fuzz issue 411312393
Inline Side-by-side
Showing 4 changed files with 10 additions and 1 deletions
fuzz/CMakeLists.txt
  View file @a078265
@@ -157,6 +157,7 @@ set(CORPUS_OTHER @@ -157,6 +157,7 @@ set(CORPUS_OTHER
157 394463491.fuzz 157 394463491.fuzz
158 398060137.fuzz 158 398060137.fuzz
159 409905355.fuzz 159 409905355.fuzz
  160 + 411312393.fuzz
160 ) 161 )
161 162
162 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) 163 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
fuzz/qpdf_extra/411312393.fuzz 0 → 100644
View file @a078265
No preview for this file type
fuzz/qtest/fuzz.test
  View file @a078265
@@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz'); @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz');
11 11
12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS"; 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13
14 -my $n_qpdf_files = 94; # increment when adding new files 14 +my $n_qpdf_files = 95; # increment when adding new files
15 15
16 my @fuzzers = ( 16 my @fuzzers = (
17 ['ascii85' => 1], 17 ['ascii85' => 1],
libqpdf/QPDF_pages.cc
  View file @a078265
@@ -109,6 +109,14 @@ QPDF::getAllPagesInternal( @@ -109,6 +109,14 @@ QPDF::getAllPagesInternal(
109 QTC::TC("qpdf", "QPDF inherit mediabox", media_box ? 0 : 1); 109 QTC::TC("qpdf", "QPDF inherit mediabox", media_box ? 0 : 1);
110 } 110 }
111 auto kids = cur_node.getKey("/Kids"); 111 auto kids = cur_node.getKey("/Kids");
  112 + if (!visited.add(kids)) {
  113 + throw QPDFExc(
  114 + qpdf_e_pages,
  115 + m->file->getName(),
  116 + "object " + cur_node.getObjGen().unparse(' '),
  117 + 0,
  118 + "Loop detected in /Pages structure (getAllPages)");
  119 + }
112 int i = -1; 120 int i = -1;
113 for (auto& kid: kids.as_array()) { 121 for (auto& kid: kids.as_array()) {
114 ++i; 122 ++i;