Treat direct page as runtime rather than logic error (fuzz issue 27393)

3 files changed, 11 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index e710d272..4c5cdf36 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2020-11-11  Jay Berkenbilt  <ejb@ql.org>
+
+	* Treat a direct page object as a runtime error rather than a
+	logic error since it is actually possible to create a file that
+	has this (fuzz issue 27393).
+
 2020-11-09  Jay Berkenbilt  <ejb@ql.org>
 
 	* Handle "." appearing in --pages not preceded by a numeric range
diff --git a/fuzz/qpdf_extra/27393.fuzz b/fuzz/qpdf_extra/27393.fuzz
new file mode 100644
index 00000000..3f6ee934
--- /dev/null
+++ b/fuzz/qpdf_extra/27393.fuzz
diff --git a/libqpdf/QPDFObjectHandle.cc b/libqpdf/QPDFObjectHandle.cc
index 472ff4e8..90e1d2d2 100644
--- a/libqpdf/QPDFObjectHandle.cc
+++ b/libqpdf/QPDFObjectHandle.cc
@@ -1512,9 +1512,11 @@ QPDFObjectHandle::coalesceContentStreams()
     {
         // Should not be possible for a page object to not have an
         // owning PDF unless it was manually constructed in some
-        // incorrect way.
-        throw std::logic_error("coalesceContentStreams called on object"
-                               " with no associated PDF file");
+        // incorrect way. However, it can happen in a PDF file whose
+        // page structure is direct, which is against spec but still
+        // possible to hand construct, as in fuzz issue 27393.
+        throw std::runtime_error("coalesceContentStreams called on object"
+                                 " with no associated PDF file");
     }
     QPDFObjectHandle new_contents = newStream(qpdf);
     this->replaceKey("/Contents", new_contents);