Skip to content

stack overflow / crash on malformed input in QPDFWriter::enqueueObject(QPDFObjectHandle) #143

Closed
@hannob

Description

@hannob

The attached file will crash qpdf. It seems it's running into an endless recursion and thus a stack overflow.
Found with afl.

qpdf-stackoverflow.zip

==24283==ERROR: AddressSanitizer: stack-overflow on address 0x7ffda4d32f78 (pc 0x00000050ba42 bp 0x7ffda4d337c0 sp 0x7ffda4d32f60 T0)
    #0 0x50ba41 in operator new(unsigned long) (/r/qpdf/qpdf+0x50ba41)
    #1 0x62c243 in PointerHolder<QPDFObject>::PointerHolder(QPDFObject*) /f/qpdf/include/qpdf/PointerHolder.hh:74:17
    #2 0x62c243 in QPDFObjectHandle::QPDFObjectHandle(QPDF*, int, int) /f/qpdf/libqpdf/QPDFObjectHandle.cc:46
    #3 0x62c243 in QPDFObjectHandle::newIndirect(QPDF*, int, int) /f/qpdf/libqpdf/QPDFObjectHandle.cc:1183
    #4 0x5b73af in QPDFObjectHandle::Factory::newIndirect(QPDF*, int, int) /f/qpdf/include/qpdf/QPDFObjectHandle.hh:520:13
    #5 0x5b73af in QPDF::getObjectByID(int, int) /f/qpdf/libqpdf/QPDF.cc:1889
    #6 0x674910 in QPDFWriter::enqueueObject(QPDFObjectHandle) /f/qpdf/libqpdf/QPDFWriter.cc:1057:27
    #7 0x67491b in QPDFWriter::enqueueObject(QPDFObjectHandle) /f/qpdf/libqpdf/QPDFWriter.cc:1057:3
    #8 0x67491b in QPDFWriter::enqueueObject(QPDFObjectHandle) /f/qpdf/libqpdf/QPDFWriter.cc:1057:3

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions