aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--TODO1
-rw-r--r--fuzz/qpdf_extra/23599.fuzzbin0 -> 369 bytes
-rw-r--r--libqpdf/QPDFPageLabelDocumentHelper.cc1
3 files changed, 1 insertions, 1 deletions
diff --git a/TODO b/TODO
index a2854a2e..092dfe1f 100644
--- a/TODO
+++ b/TODO
@@ -65,7 +65,6 @@ Fuzz Errors
* https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=<N>
* New:
- * 23599: integer overflow: https://oss-fuzz.com/testcase?key=6290807920525312
* 23642: leak: https://oss-fuzz.com/testcase-detail/4906569690251264
* Ignoring these:
diff --git a/fuzz/qpdf_extra/23599.fuzz b/fuzz/qpdf_extra/23599.fuzz
new file mode 100644
index 00000000..cd290b1a
--- /dev/null
+++ b/fuzz/qpdf_extra/23599.fuzz
Binary files differ
diff --git a/libqpdf/QPDFPageLabelDocumentHelper.cc b/libqpdf/QPDFPageLabelDocumentHelper.cc
index a650fa9c..4be9073f 100644
--- a/libqpdf/QPDFPageLabelDocumentHelper.cc
+++ b/libqpdf/QPDFPageLabelDocumentHelper.cc
@@ -53,6 +53,7 @@ QPDFPageLabelDocumentHelper::getLabelForPage(long long page_idx)
{
start = St.getIntValue();
}
+ QIntC::range_check(start, offset);
start += offset;
result = QPDFObjectHandle::newDictionary();
result.replaceOrRemoveKey("/S", S);