diff options
author | Jay Berkenbilt <ejb@ql.org> | 2020-10-31 18:10:39 +0100 |
---|---|---|
committer | Jay Berkenbilt <ejb@ql.org> | 2020-10-31 18:10:39 +0100 |
commit | 6971f78ff6fb87a7e6da6ee57e8e28ded4fe1a26 (patch) | |
tree | 59d6be7c4bf8aa38971c91f1ef9938e79a64081b | |
parent | ffe6af6f77036d9c725ce906df6020e4b5cac58d (diff) | |
download | qpdf-6971f78ff6fb87a7e6da6ee57e8e28ded4fe1a26.tar.zst |
Fix stack overflow on direct root (fuzz issue 26761)
-rw-r--r-- | ChangeLog | 4 | ||||
-rw-r--r-- | fuzz/qpdf_extra/26761.fuzz | bin | 0 -> 793 bytes | |||
-rw-r--r-- | libqpdf/QPDFWriter.cc | 3 |
3 files changed, 6 insertions, 1 deletions
@@ -1,5 +1,9 @@ 2020-10-31 Jay Berkenbilt <ejb@ql.org> + * Don't enter extension initialization in QPDFWriter on a direct + object. Fixes stack overflow in pathological case of /Root being a + direct object (fuzz issue 26761). + * My previous fix to #449 (handling foreign streams with indirect objects in /Filter and/or /DecodeParms) was incorrect and caused other problems. There is a now a correct fix to the original diff --git a/fuzz/qpdf_extra/26761.fuzz b/fuzz/qpdf_extra/26761.fuzz Binary files differnew file mode 100644 index 00000000..c565895c --- /dev/null +++ b/fuzz/qpdf_extra/26761.fuzz diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc index ba19cbb9..fcf272f6 100644 --- a/libqpdf/QPDFWriter.cc +++ b/libqpdf/QPDFWriter.cc @@ -1537,7 +1537,8 @@ QPDFWriter::unparseObject(QPDFObjectHandle object, int level, bool have_extensions_adbe = false; QPDFObjectHandle extensions; - if (old_og == this->m->pdf.getRoot().getObjGen()) + if ((old_og.getObj() != 0) && + (old_og == this->m->pdf.getRoot().getObjGen())) { is_root = true; if (object.hasKey("/Extensions") && |