From 46611f0710fa08f1a90134a84cfccec3a1e49f94 Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Fri, 11 Aug 2017 20:10:28 -0400 Subject: Prevent a division by zero error (fixes #141) Bad /W in an xref stream could cause a division by zero error. Now this is handled as a special case. --- libqpdf/QPDF.cc | 7 +++++++ libqpdf/QPDFWriter.cc | 4 ++++ 2 files changed, 11 insertions(+) (limited to 'libqpdf') diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index fc0c103f..d1360b14 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -917,6 +917,13 @@ QPDF::processXRefStream(qpdf_offset_t xref_offset, QPDFObjectHandle& xref_obj) } entry_size += W[i]; } + if (entry_size == 0) + { + throw QPDFExc(qpdf_e_damaged_pdf, this->file->getName(), + "xref stream", xref_offset, + "Cross-reference stream's /W indicates" + " entry size of 0"); + } long long max_num_entries = static_cast(-1) / entry_size; diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc index 8ee322af..8d5f0682 100644 --- a/libqpdf/QPDFWriter.cc +++ b/libqpdf/QPDFWriter.cc @@ -2056,6 +2056,10 @@ QPDFWriter::generateObjectStreams() std::vector const& eligible = QPDF::Writer::getCompressibleObjGens(this->pdf); unsigned int n_object_streams = (eligible.size() + 99) / 100; + if (n_object_streams == 0) + { + throw std::logic_error("n_object_streams == 0"); + } unsigned int n_per = eligible.size() / n_object_streams; if (n_per * n_object_streams < eligible.size()) { -- cgit v1.2.3-54-g00ecf