Handle negative numbers in QIntC::range_check (fuzz issue 26994)

1 files changed, 14 insertions, 0 deletions

diff --git a/include/qpdf/QIntC.hh b/include/qpdf/QIntC.hh
index 5f7f21bb..e3ea0a28 100644
--- a/include/qpdf/QIntC.hh
+++ b/include/qpdf/QIntC.hh
@@ -226,6 +226,11 @@ namespace QIntC // QIntC = qpdf Integer Conversion
     template <typename T>
     void range_check(T const& cur, T const& delta)
     {
+        if ((delta > 0) != (cur > 0))
+        {
+            return;
+        }
+
         if ((delta > 0) &&
             ((std::numeric_limits<T>::max() - cur) < delta))
         {
@@ -235,6 +240,15 @@ namespace QIntC // QIntC = qpdf Integer Conversion
                 << " would cause an integer overflow";
             throw std::range_error(msg.str());
         }
+        else if ((delta < 0) &&
+            ((std::numeric_limits<T>::min() - cur) > delta))
+        {
+            std::ostringstream msg;
+            msg.imbue(std::locale::classic());
+            msg << "adding " << delta << " to " << cur
+                << " would cause an integer underflow";
+            throw std::range_error(msg.str());
+        }
     }
 };