From c1684eae9144129027642f5069a0fd97f0559ec8 Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Thu, 22 Oct 2020 05:45:01 -0400 Subject: [PATCH] Check for overflow in page labels (fuzz issue 23599) --- TODO | 1 - fuzz/qpdf_extra/23599.fuzz | Bin 0 -> 369 bytes libqpdf/QPDFPageLabelDocumentHelper.cc | 1 + 3 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 fuzz/qpdf_extra/23599.fuzz diff --git a/TODO b/TODO index a2854a2..092dfe1 100644 --- a/TODO +++ b/TODO @@ -65,7 +65,6 @@ Fuzz Errors * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id= * New: - * 23599: integer overflow: https://oss-fuzz.com/testcase?key=6290807920525312 * 23642: leak: https://oss-fuzz.com/testcase-detail/4906569690251264 * Ignoring these: diff --git a/fuzz/qpdf_extra/23599.fuzz b/fuzz/qpdf_extra/23599.fuzz new file mode 100644 index 0000000..cd290b1 Binary files /dev/null and b/fuzz/qpdf_extra/23599.fuzz differ diff --git a/libqpdf/QPDFPageLabelDocumentHelper.cc b/libqpdf/QPDFPageLabelDocumentHelper.cc index a650fa9..4be9073 100644 --- a/libqpdf/QPDFPageLabelDocumentHelper.cc +++ b/libqpdf/QPDFPageLabelDocumentHelper.cc @@ -53,6 +53,7 @@ QPDFPageLabelDocumentHelper::getLabelForPage(long long page_idx) { start = St.getIntValue(); } + QIntC::range_check(start, offset); start += offset; result = QPDFObjectHandle::newDictionary(); result.replaceOrRemoveKey("/S", S); -- libgit2 0.21.4