From fabff0f3ec571b8dc423946e252c060e229c49d7 Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Tue, 22 Aug 2017 10:24:19 -0400 Subject: Limit token length during xref recovery While scanning the file looking for objects, limit the length of tokens we allow. This prevents us from getting caught up in reading a file character by character while digging through large streams. --- libqpdf/QPDFTokenizer.cc | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'libqpdf/QPDFTokenizer.cc') diff --git a/libqpdf/QPDFTokenizer.cc b/libqpdf/QPDFTokenizer.cc index 6447b93b..6cababfe 100644 --- a/libqpdf/QPDFTokenizer.cc +++ b/libqpdf/QPDFTokenizer.cc @@ -476,7 +476,8 @@ QPDFTokenizer::betweenTokens() QPDFTokenizer::Token QPDFTokenizer::readToken(PointerHolder input, std::string const& context, - bool allow_bad) + bool allow_bad, + size_t max_len) { qpdf_offset_t offset = input->tell(); Token token; @@ -507,6 +508,14 @@ QPDFTokenizer::readToken(PointerHolder input, ++offset; } presentCharacter(ch); + if (max_len && (raw_val.length() >= max_len) && + (this->state != st_token_ready)) + { + // terminate this token now + QTC::TC("qpdf", "QPDFTokenizer block long token"); + this->type = tt_bad; + this->state = st_token_ready; + } } } -- cgit v1.2.3-70-g09d2