Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix potential denial-of-service in flate stream code.
  • Loading branch information
michaelrsweet committed Mar 20, 2023
1 parent e138232 commit 97d4955
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 3 deletions.
3 changes: 2 additions & 1 deletion CHANGES.md
Expand Up @@ -2,9 +2,10 @@ Changes in PDFio
================


v1.1.1 (Month DD, YYYY)
v1.1.1 (March 20, 2023)
-----------------------

- CVE-2023-NNNNN: Fixed a potential denial-of-service with corrupt PDF files.
- Fixed a build issue.


Expand Down
19 changes: 17 additions & 2 deletions pdfio-stream.c
Expand Up @@ -1008,6 +1008,7 @@ stream_read(pdfio_stream_t *st, // I - Stream
size_t bytes) // I - Number of bytes to read
{
ssize_t rbytes; // Bytes read
uInt avail_in, avail_out; // Previous flate values


if (st->filter == PDFIO_FILTER_NONE)
Expand Down Expand Up @@ -1060,11 +1061,19 @@ stream_read(pdfio_stream_t *st, // I - Stream
st->flate.next_out = (Bytef *)buffer;
st->flate.avail_out = (uInt)bytes;

avail_in = st->flate.avail_in;
avail_out = st->flate.avail_out;

if ((status = inflate(&(st->flate), Z_NO_FLUSH)) < Z_OK)
{
_pdfioFileError(st->pdf, "Unable to decompress stream data: %s", zstrerror(status));
return (-1);
}
else if (avail_in == st->flate.avail_in && avail_out == st->flate.avail_out)
{
_pdfioFileError(st->pdf, "Corrupt stream data.");
return (-1);
}

return (st->flate.next_out - (Bytef *)buffer);
}
Expand Down Expand Up @@ -1113,12 +1122,15 @@ stream_read(pdfio_stream_t *st, // I - Stream
st->flate.avail_in = (uInt)rbytes;
}

avail_in = st->flate.avail_in;
avail_out = st->flate.avail_out;

if ((status = inflate(&(st->flate), Z_NO_FLUSH)) < Z_OK)
{
_pdfioFileError(st->pdf, "Unable to decompress stream data: %s", zstrerror(status));
return (-1);
}
else if (status == Z_STREAM_END)
else if (status == Z_STREAM_END || (avail_in == st->flate.avail_in && avail_out == st->flate.avail_out))
break;
}

Expand Down Expand Up @@ -1180,12 +1192,15 @@ stream_read(pdfio_stream_t *st, // I - Stream
st->flate.avail_in = (uInt)rbytes;
}

avail_in = st->flate.avail_in;
avail_out = st->flate.avail_out;

if ((status = inflate(&(st->flate), Z_NO_FLUSH)) < Z_OK)
{
_pdfioFileError(st->pdf, "Unable to decompress stream data: %s", zstrerror(status));
return (-1);
}
else if (status == Z_STREAM_END)
else if (status == Z_STREAM_END || (avail_in == st->flate.avail_in && avail_out == st->flate.avail_out))
break;
}

Expand Down

0 comments on commit 97d4955

Please sign in to comment.