From dd3c8e62ac41add9bad416af8b71cc5db02de029 Mon Sep 17 00:00:00 2001
From: "Sven M. Hallberg" <pesco@khjk.org>
Date: Thu, 30 Mar 2023 13:40:42 +0000
Subject: [PATCH] bounds-check /Prev pointers
Mirrors the check for startxref. I considered unifying the two into one
test at the start of the loop, but then we would lose the information
whether we got the offset from startxref or a /Prev.
---
pdf.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/pdf.c b/pdf.c
index 14e4a1d..4e159a3 100644
--- a/pdf.c
+++ b/pdf.c
@@ -5023,6 +5023,7 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *nxrefs)
* is a "linearized" PDF. in that case there should be exactly
* one xref section at the beginning of the file that is
* allowed to point forward.
+ * also, the new offset should not point outside the file.
*/
if ((uint64_t)tok->sint >= offset)
nfwd++;
@@ -5032,6 +5033,12 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *nxrefs)
offset);
break;
}
+ if ((uint64_t)tok->sint >= sz) {
+ log_message(5, "%s: /Prev pointer of xref section at "
+ "%zu (%#zx) points outside the file\n", infile,
+ offset, offset);
+ break;
+ }
offset = (size_t)tok->sint;
}
--
GitLab