Skip to content
Snippets Groups Projects
  1. Jun 29, 2021
  2. Jun 23, 2021
  3. Mar 05, 2021
  4. Mar 04, 2021
  5. Feb 26, 2021
    • xentrac's avatar
      Fix segfault on dictionaries with odd lengths · 27b2ab13
      xentrac authored
      It’s probably a bug that our dictionary parser is inserting a
      key-value “pair” into our dictionary structure which just has a key
      but no value, but the proximal cause of the crash was that `dictentry`
      is reading off the end of the key-value pair and getting a null
      pointer.
      
      This fixes the bug revealed by the instigator in input file
      assertion-a-used-failed.
      27b2ab13
    • xentrac's avatar
      Fix segfault when `decode_stream` fails in xrefs · a5abf1e2
      xentrac authored
      In instigator-crashes/aux-xrefs-segfault an invalid flate-encoded stream
      was producing this behavior:
      
          inflate: invalid distance too far back (-3)
          parse error in stream (XRef)
          ../instigator-crashes/aux-xrefs-segfault: error parsing xref section at position 249939 (0x3d053)
      
          Program received signal SIGSEGV, Segmentation fault.
          0x000055555555d91f in lookup_xref (aux=0x7fffffffdf60, nr=4, gen=0) at pdf.c:1249
          1249                    HCountedArray *subs = H_INDEX_SEQ(aux->xrefs[i], 0);
      
      What was happening was that `act_ks_value`, indirectly invoked by
      `parse_xrefs`, invoked `decode_stream`, which produced the "inflate:"
      message and returned NULL; so `act_ks_value` produced the "parse error
      in stream" message and returned an HParseResult of that NULL pointer.
      Higher up the stack `act_xrstm` packs this NULL pointer into element 0
      of a new `h_sequence`.  `parse_xrefs` was happily storing this
      `h_sequence` into `aux->xrefs[0]`, then blithely continuing to the next
      loop iteration, at which point it would report "error parsing xref
      section" and return back to main().
      
      However, this did not abort parsing the file!  main() was continuing on
      to attempt to parse the PDF file as a whole, but the first time the
      resulting parse tried to `lookup_xref`, that lookup would attempt to
      iterate over the xrefs section in the file, checking to see if the xref
      number belonged to any of them.  The line of code above then segfaulted
      while attempting to assert that the NULL was actually a valid
      `h_sequence` pointer.
      So this patch simply prevents `parse_xrefs` from treating the failed xrefs
      section as valid.  The result is that, as before, the parse exits shortly
      because it can't follow any xrefs — but now without segfaulting!
      
          inflate: invalid distance too far back (-3)
          parse error in stream (XRef)
          ../instigator-crashes/aux-xrefs-segfault: error parsing xref section at position 255242 (0x3e50a)
          VIOLATION[1]@433 (0x1b1): Missing endobj token (severity=1)
          ../instigator-crashes/aux-xrefs-segfault: no parse
          VIOLATION[1]@433 (0x1b1): Missing endobj token (severity=1)
          ../instigator-crashes/aux-xrefs-segfault: error after position 433 (0x1b1)
          [Inferior 1 (process 626584) exited with code 01]
      a5abf1e2
    • xentrac's avatar
      Report incorrect /Filter type with decode failure · 669790f1
      xentrac authored
      Previously, when the instigator produced a PDF file with a stream with
      `<</Filter 718>>` in its stream dictionary, pdf was failing by
      aborting with an assert failure.  An assert failure is not the right
      way to report that the program’s input is invalid.  This change simply
      returns NULL from `decode_stream` in this case.
      669790f1
    • xentrac's avatar
      Fix erroneous assert that never worked · 44af06e3
      xentrac authored
      This bug was only triggered when a PDF stream used AsciiHexDecode, which
      is very unusual, but it would then always be triggered if the stream
      contained two or more hex digits.
      44af06e3
  6. Jan 19, 2021
  7. Oct 01, 2020
  8. Sep 29, 2020
  9. Jun 25, 2020
  10. Jun 19, 2020
  11. Jun 01, 2020
  12. May 22, 2020
  13. May 20, 2020
  14. May 08, 2020
  15. May 04, 2020
  16. Apr 29, 2020
  17. Apr 15, 2020
Loading