diff options
author | Jay Berkenbilt <ejb@ql.org> | 2017-08-12 02:10:28 +0200 |
---|---|---|
committer | Jay Berkenbilt <ejb@ql.org> | 2017-08-12 02:11:19 +0200 |
commit | 46611f0710fa08f1a90134a84cfccec3a1e49f94 (patch) | |
tree | 0c893211acb5929ed3d6572ad2be501029c1a194 /libqpdf | |
parent | 8fe0b06cd879f503d0e5be63f706d3adda3b8203 (diff) | |
download | qpdf-46611f0710fa08f1a90134a84cfccec3a1e49f94.tar.zst |
Prevent a division by zero error (fixes #141)
Bad /W in an xref stream could cause a division by zero error. Now
this is handled as a special case.
Diffstat (limited to 'libqpdf')
-rw-r--r-- | libqpdf/QPDF.cc | 7 | ||||
-rw-r--r-- | libqpdf/QPDFWriter.cc | 4 |
2 files changed, 11 insertions, 0 deletions
diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index fc0c103f..d1360b14 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -917,6 +917,13 @@ QPDF::processXRefStream(qpdf_offset_t xref_offset, QPDFObjectHandle& xref_obj) } entry_size += W[i]; } + if (entry_size == 0) + { + throw QPDFExc(qpdf_e_damaged_pdf, this->file->getName(), + "xref stream", xref_offset, + "Cross-reference stream's /W indicates" + " entry size of 0"); + } long long max_num_entries = static_cast<unsigned long long>(-1) / entry_size; diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc index 8ee322af..8d5f0682 100644 --- a/libqpdf/QPDFWriter.cc +++ b/libqpdf/QPDFWriter.cc @@ -2056,6 +2056,10 @@ QPDFWriter::generateObjectStreams() std::vector<QPDFObjGen> const& eligible = QPDF::Writer::getCompressibleObjGens(this->pdf); unsigned int n_object_streams = (eligible.size() + 99) / 100; + if (n_object_streams == 0) + { + throw std::logic_error("n_object_streams == 0"); + } unsigned int n_per = eligible.size() / n_object_streams; if (n_per * n_object_streams < eligible.size()) { |