From ef9511219ac71b255e4b3eb106c0989816728fcc Mon Sep 17 00:00:00 2001
From: m-holger <m.holger@qpdf.org>
Date: Fri, 26 Dec 2025 17:47:05 +0000
Subject: [PATCH] Tighten named destination validation in `QPDFOutlineDocumentHelper::resolveNamedDest`: instead of accepting any Dictionary require a `/D` entry.

---
 libqpdf/QPDFOutlineDocumentHelper.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libqpdf/QPDFOutlineDocumentHelper.cc b/libqpdf/QPDFOutlineDocumentHelper.cc
index 6133afc..9947b22 100644
--- a/libqpdf/QPDFOutlineDocumentHelper.cc
+++ b/libqpdf/QPDFOutlineDocumentHelper.cc
@@ -119,7 +119,7 @@ QPDFOutlineDocumentHelper::resolveNamedDest(QPDFObjectHandle name)
                     dests,
                     qpdf,
                     [](QPDFObjectHandle const& o) -> bool {
-                        return o.isArray() || o.isDictionary();
+                        return o.isArray() || o.contains("/D");
                     },
                     true);
                 m->names_dest->validate();
--
libgit2 0.21.4