OpenSystemsDevelopment / qpdf

Commit aef099047d641a420423e9fea91c1c5e0d9199f0

Authored by m-holger
1 parent 5303b253

Enhance validation of xref entries for deleted objects.

Inline Side-by-side
Showing 4 changed files with 6 additions and 3 deletions
fuzz/CMakeLists.txt
  View file @aef0990
... ... @@ -162,6 +162,7 @@ set(CORPUS_OTHER
162 162 440599107.fuzz
163 163 440747125.fuzz
164 164 4720043549327360.fuzz
  165 + 4797504999981056.fuzz
165 166 4876793183272960.fuzz
166 167 5109284021272576.fuzz
167 168 5344352869351424.fuzz
... ...
fuzz/qpdf_extra/4797504999981056.fuzz 0 → 100644
  View file @aef0990
  1 + xref 2147483647 1 1 5 fstartxref 2
  2 +trailer<</Size 1>>
0 3 \ No newline at end of file
... ...
fuzz/qtest/fuzz.test
  View file @aef0990
... ... @@ -11,7 +11,7 @@ my $td = new TestDriver(&#39;fuzz&#39;);
11 11  
12 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13  
14   -my $n_qpdf_files = 106; # increment when adding new files
  14 +my $n_qpdf_files = 107; # increment when adding new files
15 15  
16 16 my @fuzzers = (
17 17 ['ascii85' => 1],
... ...
libqpdf/QPDF_objects.cc
  View file @aef0990
... ... @@ -533,7 +533,7 @@ Objects::read_xref(qpdf_offset_t xref_offset, bool in_stream_recovery)
533 533 max_obj = std::max(max_obj, *(m->deleted_objects.rbegin()));
534 534 }
535 535 if (size < 1 || (size - 1) != max_obj) {
536   - if (size == (max_obj + 2) && qpdf.getObject(max_obj +1, 0).isStreamOfType("/XRef")) {
  536 + if (size == (max_obj + 2) && qpdf.getObject(max_obj + 1, 0).isStreamOfType("/XRef")) {
537 537 warn(damagedPDF(
538 538 "",
539 539 -1,
... ... @@ -1132,7 +1132,7 @@ Objects::insertXrefEntry(int obj, int f0, qpdf_offset_t f1, int f2)
1132 1132 void
1133 1133 Objects::insertFreeXrefEntry(QPDFObjGen og)
1134 1134 {
1135   - if (!m->xref_table.contains(og)) {
  1135 + if (!m->xref_table.contains(og) && og.getObj() <= m->xref_table_max_id) {
1136 1136 m->deleted_objects.insert(og.getObj());
1137 1137 }
1138 1138 }
... ...