diff options
author | m-holger <m-holger@kubitscheck.org> | 2024-01-17 14:15:13 +0100 |
---|---|---|
committer | m-holger <m-holger@kubitscheck.org> | 2024-01-17 14:15:13 +0100 |
commit | ed43691bf3e1da1cefb7a4618cb809684040dd65 (patch) | |
tree | 89817345d127e2adf08f2e1ad90b1489454573fd /libqpdf | |
parent | 6e3b7982dbcf8087374694253e0e248fbc6c6e3e (diff) | |
download | qpdf-ed43691bf3e1da1cefb7a4618cb809684040dd65.tar.zst |
Tighten checks for invalid indirect references in QPDFParser
Diffstat (limited to 'libqpdf')
-rw-r--r-- | libqpdf/QPDFParser.cc | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/libqpdf/QPDFParser.cc b/libqpdf/QPDFParser.cc index 32c4f8e9..2551cf93 100644 --- a/libqpdf/QPDFParser.cc +++ b/libqpdf/QPDFParser.cc @@ -163,16 +163,15 @@ QPDFParser::parseRemainder(bool content_stream) throw std::logic_error("QPDFParser::parse called without context on an object " "with indirect references"); } - auto ref_og = QPDFObjGen( - QIntC::to_int(int_buffer[(int_count - 1) % 2]), - QIntC::to_int(int_buffer[(int_count) % 2])); - if (ref_og.isIndirect()) { + auto id = QIntC::to_int(int_buffer[(int_count - 1) % 2]); + auto gen = QIntC::to_int(int_buffer[(int_count) % 2]); + if (!(id < 1 || gen < 0 || gen >= 65535)) { // This action has the desirable side effect of causing dangling references // (references to indirect objects that don't appear in the PDF) in any parsed // object to appear in the object cache. - add(std::move(context->getObject(ref_og).obj)); + add(std::move(context->getObject(id, gen).obj)); } else { - QTC::TC("qpdf", "QPDFParser indirect with 0 objid"); + QTC::TC("qpdf", "QPDFParser invalid objgen"); addNull(); } int_count = 0; |