OpenSystemsDevelopment / qpdf

Commit fbba156ca242f42d2520e4a019f559ac94088a63

Authored by m-holger
Committed by GitHub
2 parents 0b3debaf ef492916

Merge pull request #1273 from m-holger/fuzz 

In QPDF::readObjectAtOffset fail early on 'expect n n obj'
Inline Side-by-side
Showing 1 changed file with 18 additions and 14 deletions
libqpdf/QPDF.cc
  View file @fbba156
... ... @@ -1727,24 +1727,28 @@ QPDF::readObjectAtOffset(
1727 1727 }
1728 1728  
1729 1729 m->file->seek(offset, SEEK_SET);
1730   -
1731   - QPDFTokenizer::Token tobjid = readToken(m->file);
1732   - QPDFTokenizer::Token tgen = readToken(m->file);
1733   - QPDFTokenizer::Token tobj = readToken(m->file);
1734   -
1735   - bool objidok = tobjid.isInteger();
1736   - bool genok = tgen.isInteger();
1737   - bool objok = tobj.isWord("obj");
1738   -
1739   - QTC::TC("qpdf", "QPDF check objid", objidok ? 1 : 0);
1740   - QTC::TC("qpdf", "QPDF check generation", genok ? 1 : 0);
1741   - QTC::TC("qpdf", "QPDF check obj", objok ? 1 : 0);
1742   -
1743 1730 try {
1744   - if (!(objidok && genok && objok)) {
  1731 + QPDFTokenizer::Token tobjid = readToken(m->file);
  1732 + bool objidok = tobjid.isInteger();
  1733 + QTC::TC("qpdf", "QPDF check objid", objidok ? 1 : 0);
  1734 + if (!objidok) {
1745 1735 QTC::TC("qpdf", "QPDF expected n n obj");
1746 1736 throw damagedPDF(offset, "expected n n obj");
1747 1737 }
  1738 + QPDFTokenizer::Token tgen = readToken(m->file);
  1739 + bool genok = tgen.isInteger();
  1740 + QTC::TC("qpdf", "QPDF check generation", genok ? 1 : 0);
  1741 + if (!genok) {
  1742 + throw damagedPDF(offset, "expected n n obj");
  1743 + }
  1744 + QPDFTokenizer::Token tobj = readToken(m->file);
  1745 +
  1746 + bool objok = tobj.isWord("obj");
  1747 + QTC::TC("qpdf", "QPDF check obj", objok ? 1 : 0);
  1748 +
  1749 + if (!objok) {
  1750 + throw damagedPDF(offset, "expected n n obj");
  1751 + }
1748 1752 int objid = QUtil::string_to_int(tobjid.getValue().c_str());
1749 1753 int generation = QUtil::string_to_int(tgen.getValue().c_str());
1750 1754 og = QPDFObjGen(objid, generation);
... ...