aboutsummaryrefslogtreecommitdiffstats
path: root/libqpdf/QPDFNumberTreeObjectHelper.cc
diff options
context:
space:
mode:
authorJay Berkenbilt <ejb@ql.org>2021-11-04 18:52:47 +0100
committerJay Berkenbilt <ejb@ql.org>2021-11-04 19:03:24 +0100
commita84a0b248768dcbab7fc007bb22a258cac9e4131 (patch)
tree2d05c81cf62adef6192e5038c5a41639bb65730d /libqpdf/QPDFNumberTreeObjectHelper.cc
parentec09b914434b8dbc23bf6043b13ee5d5ecf4c2a6 (diff)
downloadqpdf-a84a0b248768dcbab7fc007bb22a258cac9e4131.tar.zst
Add range check in QPDFNumberTreeObjectHelper (fuzz issue 37740)
Diffstat (limited to 'libqpdf/QPDFNumberTreeObjectHelper.cc')
-rw-r--r--libqpdf/QPDFNumberTreeObjectHelper.cc2
1 files changed, 2 insertions, 0 deletions
diff --git a/libqpdf/QPDFNumberTreeObjectHelper.cc b/libqpdf/QPDFNumberTreeObjectHelper.cc
index be2f2f16..7f510497 100644
--- a/libqpdf/QPDFNumberTreeObjectHelper.cc
+++ b/libqpdf/QPDFNumberTreeObjectHelper.cc
@@ -1,5 +1,6 @@
#include <qpdf/QPDFNumberTreeObjectHelper.hh>
#include <qpdf/NNTree.hh>
+#include <qpdf/QIntC.hh>
class NumberTreeDetails: public NNTreeDetails
{
@@ -235,6 +236,7 @@ QPDFNumberTreeObjectHelper::findObjectAtOrBelow(
return false;
}
oh = i->second;
+ QIntC::range_check_substract(idx, i->first);
offset = idx - i->first;
return true;
}