Skip to content

Commit 8249a26

Browse files
committed
Fix infinite loop in QPDFWriter (fixes #143)
1 parent 36b3fe5 commit 8249a26

File tree

5 files changed

+30
-0
lines changed

5 files changed

+30
-0
lines changed

Diff for: libqpdf/QPDFWriter.cc

+9
Original file line numberDiff line numberDiff line change
@@ -1054,6 +1054,9 @@ QPDFWriter::enqueueObject(QPDFObjectHandle object)
10541054
// here. Instead, enqueue the object stream. Object
10551055
// streams always have generation 0.
10561056
int stream_id = this->object_to_object_stream[og];
1057+
// Detect loops by storing invalid object ID 0, which
1058+
// will get overwritten later.
1059+
obj_renumber[og] = 0;
10571060
enqueueObject(this->pdf.getObjectByID(stream_id, 0));
10581061
}
10591062
else
@@ -1079,6 +1082,12 @@ QPDFWriter::enqueueObject(QPDFObjectHandle object)
10791082
}
10801083
}
10811084
}
1085+
else if (obj_renumber[og] == 0)
1086+
{
1087+
// This can happen if a specially constructed file
1088+
// indicates that an object stream is inside itself.
1089+
QTC::TC("qpdf", "QPDFWriter ignore self-referential object stream");
1090+
}
10821091
}
10831092
else if (object.isArray())
10841093
{

Diff for: qpdf/qpdf.testcov

+1
Original file line numberDiff line numberDiff line change
@@ -294,3 +294,4 @@ QPDF ignore first extra space in xref entry 0
294294
QPDF ignore second extra space in xref entry 0
295295
QPDF ignore length error xref entry 0
296296
QPDF_encryption pad short parameter 0
297+
QPDFWriter ignore self-referential object stream 0

Diff for: qpdf/qtest/qpdf.test

+1
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ my @bug_tests = (
220220
["106", "zlib data error", 3],
221221
["141a", "/W entry size 0", 2],
222222
["141b", "/W entry size 0", 2],
223+
["143", "self-referential ostream", 3],
223224
);
224225
$n_tests += scalar(@bug_tests);
225226
foreach my $d (@bug_tests)

Diff for: qpdf/qtest/qpdf/issue-143.out

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
WARNING: issue-143.pdf: can't find PDF header
2+
WARNING: issue-143.pdf (xref stream: object 3 0, file position 654): stream keyword not followed by proper line terminator
3+
WARNING: issue-143.pdf (xref stream: object 3 0, file position 607): stream dictionary lacks /Length key
4+
WARNING: issue-143.pdf (xref stream: object 3 0, file position 654): attempting to recover stream length
5+
WARNING: issue-143.pdf (xref stream: object 3 0, file position 654): recovered stream length: 36
6+
WARNING: issue-143.pdf (xref stream: object 3 0, file position 694): expected endobj
7+
WARNING: issue-143.pdf: file is damaged
8+
WARNING: issue-143.pdf (object 1 0, file position 48): expected n n obj
9+
WARNING: issue-143.pdf: Attempting to reconstruct cross-reference table
10+
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake1
11+
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake2
12+
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake3
13+
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake4
14+
WARNING: issue-143.pdf (object 1 0, file position 21): stream dictionary lacks /Length key
15+
WARNING: issue-143.pdf (object 1 0, file position 84): attempting to recover stream length
16+
WARNING: issue-143.pdf (object 1 0, file position 84): recovered stream length: 606
17+
WARNING: issue-143.pdf (object 1 0, file position 694): expected endobj
18+
WARNING: object stream 1 (file position 33): expected dictionary key but found non-name object; inserting key /QPDFFake1
19+
qpdf: operation succeeded with warnings; resulting file may have some problems

Diff for: qpdf/qtest/qpdf/issue-143.pdf

707 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)