Skip to content
Permalink
Browse files Browse the repository at this point in the history
Detect xref pointer infinite loop (fixes #149)
  • Loading branch information
jberkenbilt committed Aug 25, 2017
1 parent 2d0c687 commit 85f05cc
Show file tree
Hide file tree
Showing 5 changed files with 14 additions and 0 deletions.
5 changes: 5 additions & 0 deletions ChangeLog
@@ -1,3 +1,8 @@
2017-08-25 Jay Berkenbilt <ejb@ql.org>

* Detect infinite loop while finding additional xref tables. Fixes
#149.

2017-08-22 Jay Berkenbilt <ejb@ql.org>

* 7.0.b1: release
Expand Down
6 changes: 6 additions & 0 deletions libqpdf/QPDF.cc
Expand Up @@ -491,8 +491,10 @@ void
QPDF::read_xref(qpdf_offset_t xref_offset)
{
std::map<int, int> free_table;
std::set<qpdf_offset_t> visited;
while (xref_offset)
{
visited.insert(xref_offset);
char buf[7];
memset(buf, 0, sizeof(buf));
this->m->file->seek(xref_offset, SEEK_SET);
Expand Down Expand Up @@ -520,6 +522,10 @@ QPDF::read_xref(qpdf_offset_t xref_offset)
{
xref_offset = read_xrefStream(xref_offset);
}
if (visited.count(xref_offset) != 0)
{
xref_offset = 0;
}
}

if (! this->m->trailer.isInitialized())
Expand Down
1 change: 1 addition & 0 deletions qpdf/qtest/qpdf.test
Expand Up @@ -221,6 +221,7 @@ my @bug_tests = (
["141a", "/W entry size 0", 2],
["141b", "/W entry size 0", 2],
["143", "self-referential ostream", 3],
["149", "xref prev pointer loop", 3],
);
$n_tests += scalar(@bug_tests);
foreach my $d (@bug_tests)
Expand Down
2 changes: 2 additions & 0 deletions qpdf/qtest/qpdf/issue-149.out
@@ -0,0 +1,2 @@
WARNING: issue-149.pdf: reported number of objects (11) inconsistent with actual number of objects (7)
qpdf: operation succeeded with warnings; resulting file may have some problems
Binary file added qpdf/qtest/qpdf/issue-149.pdf
Binary file not shown.

0 comments on commit 85f05cc

Please sign in to comment.