Fix fuzz issues 15316 and 15390

Jay Berkenbilt
1 parent 456c285b
Showing 3 changed files with 9 additions and 0 deletions
fuzz/qpdf_extra/15316.fuzz
fuzz/qpdf_extra/15390.fuzz
libqpdf/QPDF.cc
+ 1 0 obj<<2147483647 0 R>>
+endobj
+trailer<</Root 1 0 R>>
 \ No newline at end of file
@@ -4,6 +4,7 @@
 #include <vector>
 #include <map>
 #include <algorithm>
+#include <limits>
 #include <stdlib.h>
 #include <string.h>
 #include <memory.h>
@@ -2151,6 +2152,11 @@ QPDFObjectHandle
 QPDF::makeIndirectObject(QPDFObjectHandle oh)
 {
     int max_objid = toI(getObjectCount());
+    if (max_objid == std::numeric_limits<int>::max())
+    {
+        throw std::range_error(
+            "max object id is too high to create new objects");
+    }
     QPDFObjGen next(max_objid + 1, 0);
     this->m->obj_cache[next] =
 	ObjCache(QPDFObjectHandle::ObjAccessor::getObject(oh), -1, -1);