Guard against object id == std::numeric_limits<int> in QPDF::insertReconstructedXrefEntry

m-holger
1 parent 60c7d594
Showing 4 changed files with 5 additions and 2 deletions
fuzz/CMakeLists.txt
fuzz/qpdf_extra/68374.fuzz
fuzz/qtest/fuzz.test
libqpdf/QPDF.cc
@@ -114,6 +114,7 @@ set(CORPUS_OTHER
   65681.fuzz
   65773.fuzz
   65777.fuzz
+  68374.fuzz
   68377.fuzz
 )
@@ -21,7 +21,7 @@ my @fuzzers = (
     ['pngpredictor' => 1],
     ['runlength' => 6],
     ['tiffpredictor' => 2],
-    ['qpdf' => 57],             # increment when adding new files
+    ['qpdf' => 58],             # increment when adding new files
     );
 my $n_tests = 0;
@@ -1195,7 +1195,9 @@ QPDF::insertFreeXrefEntry(QPDFObjGen og)
 void
 QPDF::insertReconstructedXrefEntry(int obj, qpdf_offset_t f1, int f2)
 {
-    if (!(obj > 0 && 0 <= f2 && f2 < 65535)) {
+    // Various tables are indexed by object id, with potential size id + 1
+    constexpr static int max_id = std::numeric_limits<int>::max() - 1;
+    if (!(obj > 0 && obj <= max_id && 0 <= f2 && f2 < 65535)) {
         QTC::TC("qpdf", "QPDF xref overwrite invalid objgen");
         return;
     }