From 6971f78ff6fb87a7e6da6ee57e8e28ded4fe1a26 Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Sat, 31 Oct 2020 13:10:39 -0400 Subject: Fix stack overflow on direct root (fuzz issue 26761) --- ChangeLog | 4 ++++ fuzz/qpdf_extra/26761.fuzz | Bin 0 -> 793 bytes libqpdf/QPDFWriter.cc | 3 ++- 3 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 fuzz/qpdf_extra/26761.fuzz diff --git a/ChangeLog b/ChangeLog index cdd64ee3..4c8c61b7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ 2020-10-31 Jay Berkenbilt + * Don't enter extension initialization in QPDFWriter on a direct + object. Fixes stack overflow in pathological case of /Root being a + direct object (fuzz issue 26761). + * My previous fix to #449 (handling foreign streams with indirect objects in /Filter and/or /DecodeParms) was incorrect and caused other problems. There is a now a correct fix to the original diff --git a/fuzz/qpdf_extra/26761.fuzz b/fuzz/qpdf_extra/26761.fuzz new file mode 100644 index 00000000..c565895c Binary files /dev/null and b/fuzz/qpdf_extra/26761.fuzz differ diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc index ba19cbb9..fcf272f6 100644 --- a/libqpdf/QPDFWriter.cc +++ b/libqpdf/QPDFWriter.cc @@ -1537,7 +1537,8 @@ QPDFWriter::unparseObject(QPDFObjectHandle object, int level, bool have_extensions_adbe = false; QPDFObjectHandle extensions; - if (old_og == this->m->pdf.getRoot().getObjGen()) + if ((old_og.getObj() != 0) && + (old_og == this->m->pdf.getRoot().getObjGen())) { is_root = true; if (object.hasKey("/Extensions") && -- cgit v1.2.3-70-g09d2