File 0028-Fix-for-CVE-2018-5295-Integer-overflow-at-... of Package podofo

Overview Repositories Revisions Requests Users Attributes Meta

File 0028-Fix-for-CVE-2018-5295-Integer-overflow-at-PdfXRefStreamParserObject-ParseStream.patch of Package podofo (Revision 4a2a4ab3a9916f93b2c4aaa0d77f380b)

Currently displaying revision 4a2a4ab3a9916f93b2c4aaa0d77f380b , Show latest

Subject: Patch by Matthias Brinke: Fix for CVE-2018-5295 - Integer overflow at PdfXRefStreamParserObject::ParseStream()
Url: https://sourceforge.net/p/podofo/code/1889/

--- a/podofo/trunk/src/base/PdfXRefStreamParserObject.cpp
+++ b/podofo/trunk/src/base/PdfXRefStreamParserObject.cpp
@@ -38,7 +38,7 @@
 #include "PdfStream.h"
 #include "PdfVariant.h"
 
-#include <stdio.h>
+#include <limits>
 
 namespace PoDoFo {
 
@@ -122,12 +122,26 @@
 {
     char*        pBuffer;
     pdf_long     lBufferLen;
+
+    for(pdf_int64 nLengthSum = 0, i = 0; i < W_ARRAY_SIZE; i++ )
+    {
+        if ( nW[i] < 0 )
+        {
+            PODOFO_RAISE_ERROR_INFO( ePdfError_NoXRef,
+                                    "Negative field length in XRef stream" );
+        }
+        if ( std::numeric_limits<pdf_int64>::max() - nLengthSum < nW[i] )
+        {
+            PODOFO_RAISE_ERROR_INFO( ePdfError_NoXRef,
+                                    "Invalid entry length in XRef stream" );
+        }
+        else
+        {
+            nLengthSum += nW[i];
+        }
+    }
+
     const size_t entryLen  = static_cast<size_t>(nW[0] + nW[1] + nW[2]);
-
-    if( nW[0] + nW[1] + nW[2] < 0 )
-    {
-        PODOFO_RAISE_ERROR_INFO( ePdfError_NoXRef, "Invalid entry length in XRef stream" );
-    }
 
     this->GetStream()->GetFilteredCopy( &pBuffer, &lBufferLen );

Places

File 0028-Fix-for-CVE-2018-5295-Integer-overflow-at-PdfXRefStreamParserObject-ParseStream.patch of Package podofo (Revision 4a2a4ab3a9916f93b2c4aaa0d77f380b)

Places